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BUILDING ONE DHS: WHY CAN’T MANAGE- 
MENT INFORMATION BE INTEGRATED? 


Thursday, March 1, 2012 

U.S. House of Representatives, 

Subcommittee on Oversight, Investigations, and 

Management, 

Committee on Homeland Security, 

Washington, DC. 

The subcommittee met, pursuant to call, at 9:30 a.m., in Room 
311, Cannon House Office Building, Hon. Michael T. McCaul 
[Chairman of the subcommittee] presiding. 

Present: Representatives McCaul, Farino, Keating, and Davis. 

Mr. McCaul. The committee will come to order. 

First, I would like to acknowledge the Coast Guard announced 
that one of its helicopters with four crewmen aboard crashed dur- 
ing a training mission in the vicinity of Mobile Bay in the Gulf of 
Mexico Tuesday night. 

We lost one crew member and search-and-rescue efforts are on- 
going for the others. So our hearts and thoughts and prayers go out 
to the families of these brave men and women. 

Let me thank the witnesses for being here today. I now recognize 
myself for an opening statement. This hearing is a second in the 
series of oversight hearings examining the extent to which the De- 
partment of Homeland Security has made progress building a more 
cohesive, efficient, and integrated One DHS, a department that can 
effectively thwart terrorist attacks by protecting air travelers, se- 
curing our borders, and enforcing our immigration laws. 

According to House Rules, each standing committee of the Con- 
gress must hold an oversight hearing on an issue the Government 
Accountability Office has deemed high-risk for waste, fraud, and 
mismanagement, and this is one of those hearings. After nearly a 
decade, DHS’s failure to integrate its management practices re- 
mains on the GAO’s high-risk list. Stovepiped management infor- 
mation systems continue to plague DHS with mismanagement, 
redundancies, and duplication and inefficient use of resources that 
has increased costs within the Department and bungled the imple- 
mentation of security operations. 

According to the GAO, as of December 2011, DHS has fully ad- 
dressed only two out of the 31 key actions and outcomes required 
to be removed from the high-risk list for implementing and trans- 
forming DHS. Although Secretary Napolitano has said she wants 
to build a more cohesive DHS without integration and consolida- 
tion of management functions, a One DHS will not happen. Equally 
important, taxpayer dollars will be wasted and security objectives 
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will not be met. Unfortunately, there have been too many examples 
where DHS has failed at developing and acquiring new tech- 
nologies to address the various threats to the homeland, including 
border surveillance, screening equipment, and nuclear detection 
equipment. 

SBInet is one example where the Secretary ended the original 
program after costing taxpayers nearly $1 billion to monitor only 
53 miles of the Southwest Border. SBInet failed due to the lack of 
effective program management, poorly defined requirements, inac- 
curate cost estimates, and limited access to expert guidance and 
unavailable and unreliable performance data to make informed de- 
cisions. 

The advanced spectroscopic portal program, or ASP, designed to 
improve radiation and nuclear detection capabilities at our seaports 
and land border crossings is another example where inaccurate 
data and poor acquisition management resulted in underestimated 
cost and overstated benefits. 

DHS spent $230 million on the program before it was cancelled. 
Recognizing the inherent risk of acquisitions, it is essential that 
the Department effectively leverage best practices, institutionalize 
clear governing rules and processes and enable greater disability of 
acquisition programs so immediate action can be taken when a pro- 
gram begins to experience schedule delays and cost overruns. 

GAO defines management and integration as the development of 
consistent and consolidated processes, systems, and people in areas 
such as information technology financial management acquisition 
and human capital that lead directly to greater efficiency and effec- 
tiveness of management in programs. It is essential that the inte- 
gration not be limited just within each individual management 
function but also be integrated horizontally across all core manage- 
ment functions of the Department. 

Without full integration, inconsistent reporting requirements and 
varying definitions for cost estimations across the Department can 
create inaccurate reports on a program’s true cost. The lack of inte- 
grated and consolidated core management functions, something 
that is required to effectively run any large organization, has re- 
sulted in manually-intensive data entry on Excel spreadsheets and 
data calls to prepare financial statements. 

I have a tough time understanding how Americans can 
seamlessly sign into their checking accounts on-line to check their 
balances, yet DHS is unable to produce reliable, timely, and useful 
financial information on where it is spending billions of taxpayer 
dollars. Being unable to fully monitor expenditures of billions of 
dollars is unacceptable, and the American people deserve better. 

At a time of reduced Federal budgets, the American people ex- 
pect greater transparency on how Washington manages limited re- 
sources. Industry has demonstrated through mergers and acquisi- 
tions, management information integration can be accomplished ef- 
fectively. Without it, it is impossible for any manager, either Gov- 
ernment or private corporation, to conduct oversight, improve inef- 
ficiencies, and prevent duplicative programs. 

According to the GAO, DHS continues to face challenges imple- 
menting its human capital strategic plan. DHS lacks an integrated 
human resource information technology, or HRIT, management 
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system to track workforce information critical to human resource 
planning. For example, the Federal Protective Service has yet to 
implement a human capital plan to track and report hiring, train- 
ing, and retention programs. 

DHS’s failure to address these basic management integration 
challenges are hindering our ability to provide the required train- 
ing, equipment, and information to men and women working to 
protect the United States’ homeland. 

GAO states some progress has been made in the area of manage- 
ment integration by instituting a decision support tool to monitor 
acquisitions and a Center of Excellence to share best practices 
throughout the Department. However, GAO also says considerable 
work lies ahead addressing the issue of management integration. 
I look forward to receiving the testimony today on what the De- 
partment is doing to ensure that management integration issues 
will not continue to get in the way of the Department’s need to 
carry out its mission of protecting the American people and saving 
taxpayer dollars. 

With that, I will recognize the Ranking Member of the sub- 
committee, Mr. Keating. 

[The statement of Mr. McCaul follows:] 

Statement of Chairman Michael T. McCaul 
March 1, 2012 

This hearing is the second in a series of oversight hearings to examine the extent 
to which the Department of Homeland Security has made progress building a more 
cohesive, efficient, and integrated “One DHS” — a Department that can effectively 
thwart terrorist attacks by protecting air travelers, securing our borders, and enforc- 
ing our immigration laws. 

According to House Rules, each standing Committee of the Congress must hold 
an oversight hearing on an issue the Government Accountability Office has deemed 
high-risk for waste, fraud, and mismanagement. 

After nearly a decade, DHS’s failure to integrate its management practices re- 
mains on the GAO’s High-Risk list. 

Stove-piped management information systems continue to plague DHS with mis- 
management, redundancies, and duplication, and inefficient use of resources that 
has increased costs within the Department and bungled the implementation of secu- 
rity operations. 

According to GAO, as of December 2011 DHS has fully addressed only 2 out of 
31 key actions and outcomes required to be removed from the high-risk list for “Im- 
plementing and Transforming DHS.” 

Although Secretary Napolitano has said she wants to build a more cohesive, effec- 
tive, and efficient “One DHS,” without integration and consolidation of management 
functions, a “One DHS” will not happen; and equally important, taxpayer dollars 
will be wasted and security objectives will not be met. 

Unfortunately there have been too many examples where DHS has failed at devel- 
oping and acquiring new technologies to address the various threats to the home- 
land including border surveillance, screening equipment, and nuclear detection 
equipment. 

SBInet is one example where the Secretary ended the original program after cost- 
ing taxpayers nearly $1 billion to monitor only 53 miles of the Southwest Border. 

SBInet failed due to the lack of effective program management, poorly defined 
program requirements, inaccurate cost estimations, limited access to expert guid- 
ance, and unavailable and unreliable performance data to make informative deci- 
sions. 

The Advanced Spectroscopic Portal Program, or ASP, designed to improve radi- 
ation and nuclear detection capabilities at our seaports and land border crossings 
is another example where inaccurate data and poor acquisition management re- 
sulted in underestimated costs and overstated benefits. DHS spent $230 million on 
the program before it was cancelled. 
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Recognizing the inherit risks of acquisitions, it is essential that the Department 
effectively leverage best practices, institutionalize clear governing roles and proc- 
esses, and enable greater visibility of acquisition programs so immediate action can 
be taken when a program begins to experience schedule delays and/or cost overruns. 

GAO defines management integration as the development of consistent and con- 
solidated processes, systems, and people — in areas such as information technology, 
financial management, acquisition, and human capital — that lead directly to greater 
efficiency and effectiveness of management and programs. 

It is essential that integration not be limited just within each individual manage- 
ment function, but also be integrated horizontally across all core management func- 
tions of the Department. 

Without full integration, inconsistent reporting requirements and varying defini- 
tions for cost estimations across the Department can create inaccurate reports on 
a program’s true cost. 

The lack of integrated and consolidated core management functions, something 
that’s required to effectively run any large organization, has resulted in manually- 
intensive data entry on Excel spreadsheets and “data calls” to prepare financial 
statements. 

I have a tough time understanding how Americans can seamlessly sign into their 
checking accounts on-line to check their balances yet DHS is unable to produce reli- 
able, timely, and useful financial information on where it’s spending billions of tax- 
payer dollars. 

Being unable to fully monitor expenditures of billions of dollars is unacceptable. 
The American people deserve better. 

At a time of reduced Federal budgets, the American people expect greater trans- 
parency on how Washington manages limited resources. 

Industry has demonstrated, through mergers and acquisitions, management infor- 
mation integration can be accomplished effectively. 

Without it, it is impossible for any manager, either Government or private cor- 
poration, to conduct oversight, improve efficiencies, and prevent duplicative pro- 
grams. 

According to GAO, DHS continues to face challenges implementing its Human 
Capital Strategic Plan. DHS lacks an integrated Human Resource Information Tech- 
nology, or HRIT management system to track workforce information critical to 
human resource planning. 

For example, the Federal Protective Service has yet to implement a human capital 
plan to track and report hiring, training, and retention programs. 

DHS’ failure to address these basic management integration challenges are sec- 
ond-handedly hindering our ability to provide the required training, equipment, and 
information to men and women working to protect the U.S. homeland. 

GAO states some progress has been made in the area of management integration 
by instituting a decision support tool to monitor acquisitions and a Center of Excel- 
lence to share best practices throughout the Department. However GAO also says 
considerable work lies ahead addressing the issue of management integration. 

I look forward to receiving testimony today on what the Department is doing to 
ensure that management integration issues will not continue to get in the way of 
the Department’s need to carry out its mission of protecting the American people, 
and saving taxpayer dollars. 

Mr. Keating. Thank you, Mr. Chairman. 

Earlier this year, we had the opportunity to go back 10 years and 
look at the 9/11 Commission report. I would just like to mention 
at the outset that one of the gaping holes that was called into ques- 
tion dealing with not having an integrated block so the public safe- 
ty people at all levels can talk to each other has been addressed 
since then. We have the passage of the 700 megahertz dedicated 
to that that will save lives should we face another natural disaster 
or a terrorist attack, and the so-called D Block is there, and it is 
worth noting we have made some progress on that since we had a 
hearing that emphasized that earlier this year. 

I also want to thank the panelists for being here. 

Under Secretary Borras, it is great to see you again. 

The Department of Homeland Security is one agency formed with 
22 other legacy agencies. Legacy is worth mentioning because it is 
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part of the problem we still are grasping trying to deal with today 
as we look for integration. There is no secret that since the Depart- 
ment’s inception in 2003, that its unique history has caused DHS 
officials, particularly the management division, to face multiple 
challenges in building One DHS. 

The Government Accountability Office subsequently categorized 
the Department’s transformation efforts as high-risk because of the 
economic and National security implications dealing with this kind 
of integration. 

To address this designation, the Department provided the Gov- 
ernment Accountability Office with its integrated strategy for high- 
risk management and has issued updates of the strategy in June 
and December 2011, identifying the causes of its management chal- 
lenges. 

I appreciate the Department’s efforts to further consolidate these 
efforts, but with approximately $60 billion in budgetary authority 
and over 200,000 in personnel, the need is greater than ever for the 
Department to mature into a cohesive organization with stream- 
lined management functions and operations with the capacity to 
fulfill its homeland security missions. 

The Government Accountability Office has issued upwards of 100 
recommendations since 2003 to assist the Department in shoring 
up its management integration initiatives. In an increasingly 
strained budget climate, it is imperative that the Department move 
to implement these recommendations with all deliberate speed. It 
is no longer sufficient for the Department to just develop plans and 
processes. It is a time to execute and build on the foundation that 
has been established in the interest of National security. 

In the last Congress, the Department suffered considerable fund- 
ing and staff reductions, yet progress has been made by Under Sec- 
retary for Management Borras and advancing key management ini- 
tiatives that have the potential to redirect management functions 
and operations. Notably, for the first time, the Department re- 
ceived a qualified opinion on its financial statements in fiscal year 
2011 . 

Now the Department must build on this milestone by accel- 
erating the complete implementation of initiatives to stabilize its 
internal controls and to modernize its management of financial 
management. Acquisition, management, and human capital infor- 
mation technology also have to accelerate in terms of their manage- 
ment capabilities. To succeed in achieving management integra- 
tion, Under Secretary Borras needs sufficient enforcement author- 
ity to ensure the Department’s many component agency heads and 
personnel are able to carry out the mandates for changing how 
business is conducted. Also, the Under Secretary and senior leaders 
must ensure that they secure the cooperation of component agency 
personnel if they are to succeed in implementation of their agenda 
for achieving management integration. 

With that, I look forward to today’s hearing and the testimony. 
I yield back my time. 

Mr. McCaul. I thank the Ranking Member. 

With that, I will introduce the witnesses. We have votes around 
10:15, so if we can make those opening statements concise so the 
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Members can ask questions and we can hopefully be done before 
the votes occur. 

First, Mr. Rafael Borras is the Under Secretary for Management 
and Chief Acquisitions Officer for the Department. He oversees 
management of the Department’s nearly $40 billion budget, the ap- 
propriations, expenditures of funds, accounting, and finance. He ad- 
ministers control over the Department’s $17 billion in procure- 
ments. He is also responsible for directing human capital and per- 
sonnel programs for the employees. 

Next, we have Mr. David Maurer, who is the director with the 
U.S. Government Accountability Office, Homeland Security and 
Justice Team, where he leads GAO’s work reviewing DHS and the 
Department of Justice management issues. His recent work in 
these areas include management integration, examination of the 
Quadrennial Homeland Security Review, Secret Service financial 
management, DOJ grant management, the Federal Prison System, 
and others. 

One final witness is Mr. Charles Edwards, the Acting Inspector 
General of the Department of Homeland Security. He assumed his 
position in February 2011. He served previously as a Deputy In- 
spector General of the Department of Homeland Security and has 
20 years of experience in the Federal Government and has held 
several leadership positions. 

Other committee Members may have statements and they will be 
included for the record. 

[The statement of Ranking Member Thompson follows:] 

Statement of Ranking Member Bennie G. Thompson 
March 1, 2012 

I would first like to thank Chairman McCaul for convening this hearing. 

We are here today to discuss the integration of the Department of Homeland Se- 
curity’s (Department) management functions and examine whether there is room for 
improvement. 

When the Department was created in 2002, it was the largest reorganization and 
consolidation of Government agencies, personnel, programs, and operations since 
the creation of the Department of Defense in 1949, some 53 years earlier. 

Twenty-two different agencies, many with management challenges of their own, 
were combined into one. 

These agencies brought with them aged financial management systems, cum- 
bersome acquisition policies, and inconsistent human capital policies. 

Since that time, the Department has made efforts to build these disparate oper- 
ations into one seamless system so that the thousands of men and women that work 
every day to secure our Nation will have the proper administrative and manage- 
ment functions they need to operate on a daily basis. 

When FEMA enters into a contract with a vendor for one amount, and then CBP 
enters into a contract with the same vendor for the same product for a different 
amount, that’s a problem. If those contracts were combined, money could be saved. 

When a TSA human resources manager has to log out and log into three different 
systems to determine: (1) Time and attendance records; (2) current salary; and (3) 
training attendance for one employee, that’s a problem. Combining these systems 
into one can save time, reduce errors, and streamline bureaucracy. 

When an employee that works for the Chief Financial Officer has a meeting with 
an employee that works for the Chief Information Officer and has to travel 30 min- 
utes to get to the meeting location, that’s a problem. Consolidating the Department’s 
headquarters into one location will reduce costs, travel time, and create a more har- 
monious environment among the Department’s personnel. 

Fortunately, as reflected by the President’s fiscal year 2013 budget request, the 
Department has come a long way in streamlining its efforts and under new initia- 
tives intends to go even further. 
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The new Human Resource Information Technology program, in addition to plans 
to finalize existing Data Center consolidation efforts, and the new strategy for finan- 
cial modernization are all steps in the right direction. 

If fully funded, these programs will go a long way in improving the Department’s 
integration efforts. 

I look forward to hearing testimony from Under Secretary Borras on additional 
Department plans and strategies and from our witnesses from the Government Ac- 
countability Office and the Officer of the Inspector General on improvements that 
have been made in the last 3 years and recommendations for future progress. 

I yield back the balance of my time. 

Mr. McCaul. With that, I now recognize Mr. Borras for his open- 
ing statement. 

STATEMENT OF RAFAEL BORRAS, UNDER SECRETARY FOR 

MANAGEMENT, U.S. DEPARTMENT OF HOMELAND SECURITY 

Mr. Borras. Thank you, Mr. Chairman, Ranking Member 
Keating and the other distinguished Members of the committee. 
Thank you for the opportunity to appear before you today. 

Also, Mr. Chairman, thank you for acknowledging the loss of our 
brave Coast Guard servicemen who lost their lives not quite 36 
hours ago in a training mission in the Mobile area. 

One of my top priorities during my tenure as Under Secretary for 
Management has been to improve the way we collect, store, and 
manage and use information across the Department. When I ar- 
rived at the Department almost 2 years ago, I was frustrated with 
the time and effort needed to access the necessary information to 
facilitate responsible decision making in a multibillion dollar enter- 
prise. In my private-sector experience, I was accustomed to having 
essential financial information at my fingerprints to support my de- 
cision-making responsibilities. 

While significant progress has been made to leverage business 
intelligence and integrate disparate processes and systems to im- 
prove our decision-making abilities, we still have not reached a 
fully integrated operational state. However, we have made very im- 
portant progress during the past 2 years. I am especially proud of 
the progress we made to enhance how we have managed informa- 
tion in three key areas; acquisition, finance, and human capital. 

As chief acquisition officer, I oversee the policies and processes 
and procedures used to acquire over $18 billion worth of goods and 
services each year. During my tenure, I have focused significant at- 
tention on successful delivery of major acquisition programs, which 
are imperative to supporting the front-line operations. A crucial 
step to improve the process was taken last year when I restruc- 
tured the oversight of all major acquisition programs. A key part 
of that restructuring was to elevate the Office of Program Account- 
ability and Risk Management, called PARM, to be a direct report 
to me. 

I also issued a program management and execution playbook to 
the acquisition workforce. The playbook is my vision for strength- 
ening program management and execution capabilities as an im- 
portant step to mature the acquisition management system. Most 
importantly, at my direction, PARM developed and implemented a 
business intelligence tool to monitor the operational status of each 
acquisition program. The decision support tool, or DST, is a web- 
enabled tool that provides DHS leaders and program managers 
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with a central dashboard for accessing and tracking the health of 
major acquisition programs, projects, and our portfolio programs. 

As a result of the DST and our enhanced acquisition oversight, 
we can be much more responsive and generate factual detail infor- 
mation on the health of a program investment quickly. Since Octo- 
ber 1, 2011, the DST is being used to monitor the cost, schedule, 
and performance of all of our acquisition programs. 

I am also pleased to report the Department’s financial manage- 
ment capabilities are improving. For 2011, we received a qualified 
audit opinion on two of the Department’s financial statements, a 
key accomplishment which could not have occurred without greatly 
improved ways of collecting and using data. We are harnessing the 
lessons learned from this process to design and implement broader 
business intelligence capabilities that will modernize financial 
management systems. 

Through business intelligence, we will have better access to cur- 
rent financial data, which will inform management decisions, in- 
crease accountability to stakeholders and improve the overall 
health and financial management of the Department. In March 
2011, I launched a Financial Reporting Dashboard System, FRDS, 
an enterprise-wide repository and business intelligence tool. FRDS 
uses the monthly budget execution data provided to Congress to 
produce enterprise level reports and trend analysis in user-friendly 
formats. Although it is only part of the capability we will ulti- 
mately need, we have expanded our ability to extract financial in- 
formation to improve the visibility of the component’s financial con- 
dition. 

As we move beyond the financial consolidation efforts of the past, 
we recognize the difficult financial pressures we face and will focus 
on an incremental and financially responsible approach, which in- 
cludes shoring up near-term system capabilities before moving on 
to the deployment of modernized core financial systems in those 
components that have the most pressing needs. 

One effort in aligning Human Resource Information Technology, 
or HRIT, is another key priority. In September 2010, I established 
and chaired an HRIT executive steering committee to provide 
cross-departmental leadership to the modernization efforts of our 
human resource processes. Through the executive steering com- 
mittee, we have developed a strategic plan to consolidate multiple 
HR systems throughout DHS. One of the first activities was com- 
pleting a Department-wide human resources target architecture, 
which serves as the blueprint for our HR systems’ end state. This 
work was recently awarded a 2011 Excellence in Enterprise Archi- 
tecture Award for our staff. 

In the coming months, we will standardize data sets and initiate 
pilots on enterprise business intelligence capability. My goal is for 
the decision support capability to serve as the primary source for 
DHS dashboards, where performance program and portfolio man- 
agement, financial acquisition and human capital information, and 
other DHS data sets are obtained from the DHS systems of record. 
Those dashboards will be integrated to provide a better view into 
the Department’s mission performance and identify efficiency op- 
portunities. 
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My approach to using information to help integrate DHS can be 
summed up as follows: I am building a solid sustainable foundation 
that is being implemented and executed using best practices with 
good stewardship of the taxpayer’s dollars. We will continue to use 
a modular and agile approach to add capabilities that avoid dupli- 
cation while enhancing our ability to collect, analyze, and report on 
the business of DHS to help informed decision making and enhance 
our management integration. Along the way, we are helping to fos- 
ter the One DHS culture that is necessary to continue to mature 
our Department and support our operators in the execution of their 
mission. 

Once again, I thank you for the opportunity to be before you 
today, and I look forward to answering your questions. 

[The statement of Mr. Borras follows:] 

Prepared Statement of Rafael Borras 
March 1, 2012 

Chairman McCaul, Ranking Member Keating, and other distinguished Members 
of the committee, I thank you for the opportunity to appear before you today and 
discuss our efforts to integrate management information and to build One DHS. 

One of my top priorities during my tenure as Under Secretary for Management 
(USM) has been to improve the way we collect, store, and manage data across the 
Department in order to improve executive level decision making. When I arrived at 
the Department almost 2 years ago, I was frustrated with the time and effort need- 
ed to retrieve data I needed to oversee a multi-billion dollar enterprise. In my pri- 
vate sector experience, I was accustomed to having key financial, human capital, 
and procurement data at my fingertips. 

One of my first actions was to direct my line-of-business chiefs to work with their 
component counterparts to mature the Department’s data management and better 
support our enterprise level decision-making capabilities. While significant progress 
has been made to leverage business intelligence and integrate disparate processes 
and systems, we still have work to do in order to reach a fully integrated oper- 
ational state. Today, I would like to present some of the important progress that 
has been made over the past 2 years and outline the way forward to continue to 
build out the support systems to allow DHS to make better-informed decisions. In 
many ways, this effort is at the core of improving our “One DHS” culture. 

Historically, much of the data available to Department of Homeland Security 
(DHS) leadership has been generated through manual data calls, which are labor- 
intensive and have a greater risk of inaccurate or incomplete content. In response, 
we have begun developing standard data sources and reporting mechanisms to pro- 
vide timely and accurate data across all lines of business. 

We have made progress in implementing several systems to reduce manual data 
calls and improve accuracy and completeness of information. Some of our solutions 
that are successfully providing quality data are the Department of Homeland Secu- 
rity Treasury Information Executive Repository, the Fleet Management Analysis 
and Reporting System, the Financial Reporting Dashboard System, and most re- 
cently the Decision Support Tool, which became the official source of acquisition pro- 
gram execution information and data on October 1, 2011. These solutions provide 
robust business intelligence (BI) over disparate data sources, collating information 
to improve decision-making through access to accurate program data and metrics. 
Deploying business intelligence solutions across the financial management spectrum 
has improved Departmental compliance with the Chief Financial Officer (CFO) Act 
and DHS Financial Accountability Act, OMB guidance, other regulations, and Gov- 
ernment accounting standards. 

I firmly believe that utilizing BI tools will improve the effectiveness of manage- 
ment and achieve compliance, performance, and quality improvement goals by pro- 
viding: 

• Enhanced access to key financial data across organizational boundaries, 

• Key indicators of acquisition health that are data-driven and risk-informed, and 

• Improved human capital and resource management to enable emerging organi- 
zational opportunities. 

To house the BI solutions, the Department recognizes the need for a common 
place for systems and data to reside in a private cloud environment. In alignment 
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with OMB’s Federal Data Center Consolidation Initiative, our Office of the Chief In- 
formation Officer (CIO) is in the process of consolidating 43 of the Department’s leg- 
acy data centers into two Enterprise Data Centers (EDC), known as “DC1” and 
“DC2.” The consolidation of numerous component systems at our EDCs enables 
more effective collection and use of business information across the enterprise and 
the Department’s fiscal year 2013 budget request includes nearly $65 million to 
fully complete the migration of data centers for three of our largest components. 

One example of this increased effectiveness is the deployment of SharePoint-as- 
a-Service in our EDCs. Numerous human resource, financial, and administrative 
systems use SharePoint. By migrating these SharePoint systems to a common plat- 
form within our data centers, we enable the appropriate data aggregation across 
components to improve enterprise decision-making. Additional benefits of consolida- 
tion include ensuring that DHS has a seamless disaster recovery capability and sig- 
nificantly enhancing the cybersecurity posture of DHS systems. 

Since I last testified before this committee, I have worked closely with my col- 
leagues in the components, as well as my line-of-business chiefs, to mature our orga- 
nizational effectiveness across DHS. I am especially proud of our progress to en- 
hance the three key management disciplines of acquisition management, financial 
management, and human capital management. The Department has made signifi- 
cant progress to improve in these areas. 

I welcome the opportunity to focus first on the significant achievements in the ac- 
quisition management area. 


ACQUISITION MANAGEMENT 

The successful delivery of major programs is imperative to our Department. Near- 
ly half of the DHS budget is dedicated to obtaining goods and services to support 
and improve our capabilities, including over $18 billion in investments in our acqui- 
sition programs. Due to the nature of how quickly the Department was stood up and 
the many legacy and new agencies it encompassed, DHS’s earliest acquisition proc- 
esses were imperfect and slow to mature. Today’s acquisition practices are vastly 
improved in terms of process, oversight, and collaboration. We are working collabo- 
ratively with our partners across DHS to enhance our acquisition practices so that 
we are efficient and effective in delivering critical capabilities. 

In the early days, DHS was operating in disparate silos focused on purchasing 
goods and services with minimal management of requirements. Today we are much 
more efficient because we have a more robust acquisition practice that focuses on 
requirements and program management, enhanced guidance on testing, and train- 
ing and certification of our professional workforce. Departmental leadership is better 
equipped than ever to make risk-informed acquisition decisions. 

A crucial step in this process was taken in the second quarter of fiscal year 2011, 
when I restructured oversight of all major acquisition programs. A key part of this 
restructuring was the elevation of the Program Accountability and Risk Manage- 
ment (PARM) to be a direct report to me to support my role as the Under Secretary 
for Management. PARM manages and implements Acquisition Management Direc- 
tive (MD) 102-01, serves as the Executive Secretariat to the Acquisition Review 
Board (ARB) and the Component Acquisition Executive (CAE) Council, and guides 
managers of major investments through the acquisition governance process. PARM 
also provides independent assessments of major investment programs and works 
with DHS partners to enhance business intelligence to inform ARB decisions. It 
monitors programs between formal reviews to identify any emerging issues that 
DHS needs to address to keep the programs on track. PARM guides programs to 
success. 

To establish a vision for enhancing program execution, in December 2011, I issued 
the Program Management & Execution Playbook, called the Playbook, to the acqui- 
sition workforce. The Playbook is my vision for strengthening program management 
and execution capabilities, and maturing the acquisition management system. The 
Playbook addresses several management priorities, including increasing the exper- 
tise and capabilities of the acquisition and program management workforce, improv- 
ing program execution, increasing access to expert guidance and best practices, and 
increasing access to reliable and useful program performance data. 

In addition to managing the day-to-day oversight of acquisition programs, PARM 
has developed and implemented a business intelligence tool to monitor the oper- 
ational status of each acquisition program. The Decision Support Tool (DST) is a 
web-enabled tool that provides DHS leaders, governance boards, and program man- 
agers with a central dashboard for assessing and tracking the health of major acqui- 
sition projects, programs, and portfolios. The DST creates graphs, charts, and other 
views of key indicators of program health, such as cost, funding, and schedule. My 



11 


goal is to improve program accountability and to strengthen the Department’s abil- 
ity to make sound strategic decisions throughout the life cycle of major acquisitions. 

The DST became the official source of Acquisition Decision Event information and 
data on October 1, 2011. It is already informing ARBs with standardized informa- 
tion. On February 13, 2012, I issued a memorandum once again calling on all com- 
ponents and programs to ensure that on a monthly basis all acquisition program 
information reported in the Department existing data systems is complete, accurate, 
and valid. 

One aspect of the DHS vision is to shift the program management paradigm to- 
ward being more data-driven, with emphasis on the criticality of maintaining qual- 
ity data within DHS source systems. One significant result of this shift in culture 
is evidenced in the development and delivery of the Comprehensive Acquisition Sta- 
tus Report (CASR). 

The CASR provides the status of DHS major acquisitions listed in the “Depart- 
ment of Homeland Security Major Acquisition Oversight List.” Previous DHS Con- 
gressional reports provided limited detail and took several months to compile. The 
new CASR format increases the quality of information and can be produced in less 
time. As our business intelligence capability and data fidelity efforts continue to ma- 
ture, the already greatly condensed time line will leverage DST automation to mine 
program data to feed the CASR in near-real-time. 

From the procurement perspective, the Department has also matured. In Novem- 
ber 2011, we implemented a comprehensive Procurement Health Assessment Pro- 
gram for all nine contracting activities across DHS. This Health Assessment is a 
robust management information system to monitor and evaluate the performance of 
contracting operations and support across 30 specific Chief Procurement Officer 
(CPO) initiatives. In order to integrate our assessment system throughout all DHS 
procurement activities, we implemented a business intelligence tool, the Enterprise 
Reporting Application (ERA), to extract data from several sources into a single data 
warehouse. This system allows each Head of Contracting Activity (HCA) and the 
CPO to monitor key performance metrics, such as competition rates, small business 
contracting progress, acquisition savings initiatives, data accuracy, and employee 
training and certification status on a daily basis and take immediate corrective ac- 
tion. Our Health Assessment Program also provides us with the ability to perform 
an extensive mid-year and end-of-year performance review with each contracting ac- 
tivity, as well as to establish specific goals for the upcoming fiscal year. 

The Department is making significant progress to improve acquisition manage- 
ment and program execution. We are continuing to drive our governance processes 
forward to ensure greater program accountability. 

FINANCIAL MANAGEMENT 

The Department is designing and implementing business intelligence capabilities 
that will modernize financial systems. Through BI, we will have better access to 
current financial data, which will inform management decisions, increase account- 
ability to stakeholders, and improve the overall health of financial management. 

For the past 4 years, we have generated the audited financial statements for the 
Department and components through a critical reporting tool known as DHSTIER 
(Department of Homeland Security Treasury Information Executive Repository). The 
tool consolidates summary-level financial data from fifteen components and offices, 
generating the core financial reporting for the Department. 

The use of DHSTIER has enhanced the efficiency of generating financial state- 
ments and is essential for meeting our reporting requirements, as well as the accel- 
erated time frames for producing the Annual Financial Report. DHSTIER provides 
near-real-time financial statement data immediately upon data upload in the sys- 
tem. The system is proven, audited, and consistently delivers the required financial 
reports for DHS. 

Currently, we are implementing a new DHS data element to capture Program 
Project Activity (PPA) in financial systems. By the second quarter of fiscal year 
2013, PPA data will feed into DHSTIER from the component financial systems, giv- 
ing us an automated, standardized way of categorizing and accounting for DHS PPA 
funds and providing visibility into budget execution data reporting down to the pro- 
gram level. 

In March 2011, I launched the Financial Reporting Dashboard System (FRDS), 
an enterprise-wide data repository and business intelligence tool. FRDS uses the 
monthly budget execution data provided to Congress to produce enterprise-level re- 
ports and trend analysis in user-friendly formats for Departmental leadership. This 
system increases our ability to validate and improve data, which in turn provides 
greater transparency and better information for decision making. Automating the 
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collection and validation of budget execution data will improve our response time 
to inquiries from stakeholders. 

FRDS provides some additional reporting capabilities and automates others that 
were previously compiled manually. We can produce reports that display data from 
multiple levels and sources, including Departmental totals. Further, we can drill 
down from these enterprise-level reports to obtain execution data by component or 
by Treasury Account Fund Symbol (TAFS). We are also bringing DHSTIER financial 
data into FRDS, which will strengthen and validate the Monthly Execution Report. 

We have established standard data elements and are working to implement a 
common line of accounting to provide timely, accurate, useful, and actionable finan- 
cial information to decision makers and stakeholders and to prevent waste, fraud, 
and abuse. This will increase data sharing capabilities and interoperability, mini- 
mize the time required to crosswalk data elements, and include applicable Federal 
and National standards to provide the foundation for accurate, timely, and reliable 
Departmental financial reporting. 

Qualified Opinion 

A significant example of the progress being made in the Department’s financial 
management area is exhibited by our recent qualified opinion. Obtaining this opin- 
ion is significant progress towards addressing a key weakness identified by GAO. 

The CFO conducted targeted risk assessments to identify and remediate weak- 
nesses in accounting and financial reporting. We established mission action plans 
for the Department’s most significant challenge areas and monitored progress 
against those plans throughout the fiscal year. As a result of these efforts, DHS re- 
ceived a qualified audit opinion on its fiscal year 2011 Consolidated Balance Sheet 
and Statement of Custodial Activity. This accomplishment is significant because it 
increases transparency and accountability for the Department’s resources. 

The CFO will expand the scope of the fiscal year 2012 audit, with the goal of ob- 
taining an opinion on all five financial statements. The Department will continue 
to implement a risk-based approach to audit remediation and will work closely with 
components to mitigate any risk of new material weaknesses or audit qualifications 
as a means to sustain prior-year successes. 

Finally, DHS has also made significant progress identifying and recovering im- 
proper payments through general recovery audits, testing of high-risk programs, 
and execution of corrective action plans. In fiscal year 2011, the CFO began targeted 
recovery audits for high-risk payment types. One such audit focused on tele- 
communication invoices and resulted in $4 million in recoverable improper payment 
claims, $100,000 in immediate cost savings, and $2 million in estimated future cost 
savings. We are developing additional measures, such as risk-based analytic tools 
and stronger internal controls, to reduce the probability of future improper pay- 
ments. 


HUMAN RESOURCES MANAGEMENT 

Aligning human resources information technology (HRIT) to increase timeliness 
and efficiency of DHS human capital operations is a goal included in the Depart- 
ment’s Workforce Strategy for FY 2011-2016. 

In September 2010, I established the Human Resources Information Technology 
Executive Steering Committee, a formal governance board of human capital, train- 
ing, and IT executive representatives from every DHS component and additional 
leadership from across my organization. Our first order of business was initiating 
the first application of Federal Segment Architecture at DHS. The Human Capital 
Segment Architecture (HCSA) project provided a clear understanding of the best 
and most appropriate ways to align the Department’s Human Capital resources — 
people, technology, data, and systems — to serve the Department’s critical mission ef- 
fectively and efficiently. DHS received an award titled, Leadership in Government 
Transformation Using Enterprise Architecture, for this project at the annual Excel- 
lence in Enterprise Architecture Awards ceremony in November 2011. 

In 2010, the Office of the Chief Human Capital Officer (CHCO), in partnership 
with CBP, implemented the COGNOS Business Intelligence environment that pro- 
vides self-service data analysis and reporting for CHCO end-users to better direct 
their programs. A few significant accomplishments to date include: Field definitions 
and value calculations have been identified and standardized in accordance with 
regulatory classifications established by OPM; all personnel historical data has been 
populated; desktop capability for end-users to generate reports has been developed 
along with recurring reports; and the capability for recipients to execute their own 
reports has been developed. We have created end-user canned reports for inclusion 
in the standard report library which provides a more efficient means for producing 
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enterprise reports. Planned initiatives are to populate the COGNOS technology with 
payroll data and automate the HR dashboard. 

Additionally, during 2011, I directed CHCO to partner with CIO to create a capa- 
bility to electronically transfer personnel files, including background investigations. 
Our implementation of the eDelivery feature eliminated the need to get in a car and 
drive to the location(s) where the investigative files were located. This also elimi- 
nated hours of manual processing. We can now get what we need in near-real-time, 
greatly reducing the time to adjudicate on the back end of the on-boarding process. 
In fiscal year 2011, we averaged approximately 25 days to adjudicate a case. Today, 
we average approximately 15 days, five fewer days than that required to meet Fed- 
eral guidelines. Therefore, we have reduced the time by 10 days, 80 percent of which 
is attributed to the eDelivery system. 

Other Uses of Business Intelligence 

Clearly, BI is helping to transform our acquisition, financial, and human capital 
management practices across the Department. We are also focusing on going beyond 
capturing data to inform decisions but also to control our limited resources. The im- 
proved management of our physical assets has the added benefit of detecting waste, 
fraud, and abuse. While these initiatives may be different, each initiative shares a 
similar technical solution which leads us to building integration and “One DHS.” 
The Office of the Chief Administrative Officer (CAO) has business intelligence ini- 
tiatives capturing and reporting on asset data. 

In December 2010, we initiated an agency-wide review of the fleet program focus- 
ing on Vehicle Allocation Methodology (VAM). Each of the 13 DHS components oper- 
ating motor vehicles participated in this collaborative effort, which included DHS 
headquarters. This analysis identified the current and future vehicle inventory re- 
quirements to achieve a diverse set of missions across the agency. As a result of 
this collaborative review components identified a 3 percent reduction in vehicle in- 
ventory. A 3 percent reduction translates to approximately $74 million in cost avoid- 
ance with the combination of acquisitions, fuel, and maintenance. The VAM analysis 
will be conducted annually, and DHS will continue to review its fleet program with 
the goal to further reduce its vehicle fleet while maintaining affordable readiness. 

To date, DHS has identified and centralized all real estate holdings and is in the 
process of integrating this data with multiple components’ personal property sys- 
tems as a means to populate and maintain data currency in the data warehouse. 
In addition, the platform utilized by each line-of-business is standardized and will 
be integrated to promote enterprise use of data sets across business lines. This capa- 
bility will serve as a “One DHS” decision support and management intelligence serv- 
ice in the area of personal property that will utilize integration as a key element 
to maturing the Department towards a “One DHS” model. 

CONCLUSION 

The Department has made good progress to date. All Management Directorate 
line-of-business offices are developing information standards for their respective 
functions and are using the Department’s business intelligence service to develop 
dashboards from both internal and external stakeholders. It is expected that over 
the next 12 months, we will standardize data sets and initiate pilots on enterprise 
business intelligence capability. 

My goal is for the decision support capability to serve as the primary source for 
DHS dashboards where performance, program and portfolio management, financial, 
acquisition, human capital, asset management, enterprise architecture, cyber, and 
other DHS data sets are obtained from the DHS systems of record. Those dash- 
boards will be integrated to provide a better view into the Department’s mission 
performance and identify efficiency opportunities. 

As I have stated in previous public statements, one of my first official acts upon 
becoming Under Secretary for Management was to issue a memo authorizing a man- 
ual data call. At that time, a manual data call was the only method to collect infor- 
mation across the Department. It was clear to me then, as it is now, that to best 
serve the Department of Homeland Security and allow leadership to make more 
timely and accurate mission-related decisions, building better and integrated infor- 
mation systems needed to be a priority. In fact, these capabilities now exist through 
a powerful set of systems that form the core of our emerging suite of our business 
analytics. These tools are bringing DHS more in line to become, as the Secretary 
has prioritized, a better integrated or One DHS. 

Once again, I thank you for the opportunity to appear before you today, and I look 
forward to answering your questions. 

Mr. McCaul. Thank you, Mr. Borras. 
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The Chairman now recognizes Mr. Maurer for his opening state- 
ment. 

STATEMENT OF DAVID C. MAURER, DIRECTOR, HOMELAND SE- 
CURITY AND JUSTICE TEAM, GOVERNMENT ACCOUNT- 
ABILITY OFFICE 

Mr. Maurer. Good morning, Chairman McCaul, Ranking Mem- 
ber Keating, and other Members and staff. I am pleased to be here 
today to discuss DHS’s on-going efforts to build an integrated and 
unified department. 

As you have already noted, from the day DHS opened its doors 
in 2003, GAO designated its implementation as high-risk. Com- 
pleting its transformation into a cohesive department is critical to 
achieving its homeland security missions. Doing so will require con- 
tinued progress in human capital, information technology, and ac- 
quisition in financial management, as well as integrating these 
functions across the Department. 

Now, these are broad areas so I am going to focus my comments 
this morning on a few key points. First, to carry out its vital daily 
missions, DHS needs a strong uniformed management foundation. 
This includes the ability to obtain a clean financial opinion, deploy 
new technologies on time and within budget, and identify and fill 
key skill gaps across the Department. We have provided DHS 31 
outcomes like these, which DHS has agreed to accomplish. Collec- 
tively, these outcomes identify where they want to go. But DHS 
isn’t there yet. 

It currently lacks vital management capabilities to integrate the 
Department into something greater than the sum of its parts. For 
example, DHS faces challenges identifying and meeting acquisition 
program requirements, and only a small number of DHS’s major 
acquisitions have validated cost estimates. DHS twice attempted 
and was unable to build an integrated Department-wide financial 
management system. DHS also lacks comprehensive Department- 
level visibility over key human capital information. 

Now, in recent years, DHS has worked hard to fix its manage- 
ment problems and has achieved some key successes. For example, 
last year DHS obtained a qualified audit opinion on its balance 
sheet for the first time since its creation. DHS has lowered its sen- 
ior level — senior leadership vacancy rates from a peak of 25 percent 
in 2006 to 10 percent in 2011. We have also seen significant senior 
level support for a series of plans to help ensure DHS missions are 
ably supported by a sound management infrastructure. In par- 
ticular, the Department’s December 2011 strategy for addressing 
high risk is a good roadmap for moving DHS from where it is now, 
a department with several management challenges, to where it 
wants to be, a unified department supported by integrated manage- 
ment functions that is no longer on our high-risk list. 

To further strengthen its plans, we would suggest among other 
things establishing measures and reporting on progress for all ini- 
tiatives, which brings me to my final point, which is especially im- 
portant: DHS needs to focus on executing its plans. The Depart- 
ment has laid out an ambitious agenda and has considerable work 
ahead to achieve its goals. For example, DHS is rolling out plans 
for improving how it manages investments across the Department. 
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However, it still needs to implement several changes to make this 
happen. DHS continues to face challenges implementing informa- 
tion security controls and managing its IT acquisitions, which it is 
trying to address through, among other things, a new approach to 
overseeing IT investments. On the financial front, DHS recently 
announced a new approach for modernizing its financial systems 
but is still years away from complete implementation and con- 
tinues to have material weaknesses and internal controls over fi- 
nancial reporting. 

In short, while DHS has made important strides addressing its 
management challenges, the Department still has a great deal of 
work ahead of executing its plans. Doing so is important because 
building a solid management foundation will help DHS carry out 
its important missions. 

Mr. Chairman, thank you for the opportunity to testify this 
morning. I look forward to your questions. 

[The statement of Mr. Maurer follows:] 

Prepared Statement of David C. Maurer 
March 1, 2012 

GAO HIGHLIGHTS 

Highlights of GAO-12-365T, a testimony before the Subcommittee on Oversight, 
Investigations, and Management, Committee on Homeland Security, House of Rep- 
resentatives. 

Why GAO Did This Study 

Since 2003, GAO has designated the implementation and transformation of DHS 
as high-risk because, among other things, DHS had to combine 22 agencies, while 
ensuring no serious consequences for U.S. National and economic security. This 
high-risk area includes challenges in DHS’s management functions — financial man- 
agement, human capital, IT, and acquisitions; the effect of those challenges on im- 
plementing DHS’s missions; and integrating the functions. In November 2000, GAO 
published criteria for removing areas from its high-risk list. In September 2010, 
GAO identified 31 actions and outcomes critical to addressing this high-risk area. 
This testimony addresses DHS’s progress in: (1) Developing a strategy for address- 
ing its high-risk designation, and (2) achieving outcomes critical to addressing this 
high-risk area. This statement is based on GAO products issued from June 2007 
through February 2012, including selected updates. It also includes preliminary ob- 
servations from GAO’s on-going work reviewing DHS’s IT governance. GAO re- 
viewed documents on IT governance and interviewed officials. 

What GAO Recommends 

This testimony contains no new recommendations. GAO has made over 100 rec- 
ommendations to DHS since 2003 to strengthen the Department’s management and 
integration efforts. DHS has implemented many of these recommendations and is 
in the process of implementing others. 

DEPARTMENT OF HOMELAND SECURITY. — CONTINUED PROGRESS MADE IMPROVING AND 
INTEGRATING MANAGEMENT AREAS, BUT MORE WORK REMAINS 

What GAO Found 

The Department of Homeland Security (DHS) has updated and strengthened its 
strategy for how it plans to address GAO’s high-risk designation and resolve the De- 
partment’s management challenges. In January 2011, DHS provided GAO with its 
Integrated Strategy for High-Risk Management, which summarized the Depart- 
ment’s preliminary plans for addressing the high-risk area. GAO found that this 
strategy, which was later updated in June and December 2011, was generally re- 
sponsive to the actions and outcomes needed to address GAO’s high-risk designa- 
tion. For example, the January 2011 strategy generally identified multiple, specific 
actions and target completion time frames consistent with the outcomes GAO identi- 
fied. However, the strategy did not address the root causes of problems, among 
other things. In its June 2011 strategy, DHS, among other things, identified 10 root 
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causes that cut across the management areas and their integration. Nevertheless, 
GAO identified ways the strategy could be strengthened, including consistently re- 
porting the progress of its initiatives and corrective actions. In its most recent up- 
date, DHS better positioned itself to address its management challenges. For exam- 
ple, for the first time, DHS included ratings of the Department’s progress address- 
ing its high-risk outcomes. However, GAO believes that DHS could more consist- 
ently report on available resources and corrective actions, establish measures and 
report on progress made for all initiatives, and stabilize its methodology for meas- 
uring progress. These changes, if implemented and sustained, provide a path for 
DHS to address GAO’s high-risk designation. 

DHS has made progress, but has considerable work ahead to achieve actions and 
outcomes critical to addressing this high-risk area. Among other accomplishments, 
DHS realigned its acquisition management functions within a new office to assess 
the health of major acquisitions and investments; conducted program and portfolio 
reviews of hundreds of information technology (IT) investments; and reduced the 
number of material weaknesses in internal controls. DHS also demonstrated top 
leadership commitment by identifying roles and responsibilities for its key manage- 
ment initiatives. However, DHS has more work ahead to fully implement its plans 
and address its management challenges. For example, in June 2010 GAO reported 
that over half of the programs reviewed awarded contracts to initiate acquisition ac- 
tivities without component or Department approval of essential planning docu- 
ments. In addition, DHS faces challenges fully defining key system investment and 
acquisition management policies and procedures. Further, as of September 30, 2011, 
due to material weaknesses in internal controls over financial reporting, DHS was 
unable to provide assurance that these internal controls were operating effectively. 
In September 2011 we reported that DHS also continues to face challenges imple- 
menting some key human capital initiatives, such as its workforce strategy. DHS 
also needs to continue to demonstrate sustainable progress in integrating its man- 
agement functions within and across the Department and its components, including 
making progress with its model for managing investments across components and 
management functions. GAO will continue to assess DHS’s efforts to address its 
high-risk designation and will report its findings on the Department’s progress in 
the high-risk update that it expects to issue in early 2013. 

Chairman McCaul, Ranking Member Keating, and Members of the subcommittee: 
I am pleased to be here today to discuss the Department of Homeland Security’s 
(DHS) on-going efforts to build a single, unified department. DHS now has more 
than 200,000 employees and almost $60 billion in budget authority, and completing 
its transformation into a cohesive department is critical to achieving its homeland 
security missions. Our prior work on mergers and organizational transformations, 
undertaken before the creation of DHS, found that successful transformations of 
large organizations, even those faced with less-strenuous reorganizations than DHS, 
can take years to achieve. 1 Since the Department’s creation in 2003, GAO has des- 
ignated the implementation and transformation of DHS as high-risk because DHS 
had to combine 22 agencies — several with major management challenges — into one 
department, and failure to effectively address DHS’s management and mission risks 
could have serious consequences for U.S. National and economic security. 2 This 
high-risk area includes challenges in strengthening DHS’s management functions — 
financial management, human capital, information technology (IT), and acquisition 
management — the effect of those challenges on DHS’s mission implementation, and 
challenges in integrating management functions within and across the Department 
and its components. 


1 See GAO, Highlights of a GAO Forum: Mergers and Transformations: Lessons Learned for 
a Department of Homeland Security and Other Federal Agencies, GAO-03— 293SP {Washington, 
DC: Nov. 14, 2002) and Results-Oriented Cultures: Implementation Steps to Assist Mergers and 
Organizational Transformations, GAO— 03— 669 (Washington, DC: July 2, 2003). 

2 GAO, High-Risk Series: An Update, GAO-03-119 (Washington, DC: January 2003). In addi- 
tion to this high-risk area, DHS has responsibility for other areas we have designated as high- 
risk. Specifically, in 2005 we designated information sharing for homeland security as high-risk, 
involving a number of Federal departments to include DHS, and in 2006, we identified the Na- 
tional Flood Insurance Program as high-risk. Further, in 2003 we expanded the scope of the 
high-risk area involving Federal information security, which was initially designated as high- 
risk in 1997, to include the protection of the Nation’s computer-reliant critical infrastructure. 
GAO High-Risk Series: An Update, GAO-09—271 {Washington, DC: January 2009); High-Risk 
Series: An Update, GAO— 07-310 {Washington, DC: January 2007); and High-Risk Series: An Up- 
date, GAO— 05-207 (Washington, DC: January 2005). 
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In November 2000, we published our criteria for removing areas from the high- 
risk list. 3 Specifically, agencies must have: (1) A demonstrated strong commitment 
and top leadership support to address the risks; (2) the capacity (that is, the people 
and other resources) to resolve the risks; (3) a corrective action plan that identifies 
the root causes, identifies effective solutions, and provides for substantially com- 
pleting corrective measures in the near-term, including but not limited to steps nec- 
essary to implement solutions we recommended; (4) a program instituted to monitor 
and independently validate the effectiveness and sustainability of corrective meas- 
ures; and (5) the ability to demonstrate progress in implementing corrective meas- 
ures. 

On the basis of our prior work, in September 2010 we identified and provided to 
DHS 31 actions and outcomes that are critical to addressing the challenges within 
the Department’s management areas and in integrating those functions across the 
Department. These key actions and outcomes include, among others, obtaining and 
then sustaining unqualified audit opinions for at least 2 consecutive years on the 
Department-wide financial statements; validating required acquisition documents in 
accordance with a Department-approved, knowledge-based acquisition process; and 
demonstrating measurable progress in implementing its IT human capital plan and 
accomplishing defined outcomes. 4 DHS committed to taking actions to address all 
31 of these outcomes. Achieving and sustaining progress in these areas would dem- 
onstrate the Department’s ability and commitment to addressing our five criteria for 
removing issues from the high-risk list. 

My testimony this morning will discuss our observations, based on prior and on- 
going work, on DHS’s progress in: (1) Developing a strategy for addressing its high- 
risk designation for the implementation and transformation of the Department, and 
(2) achieving outcomes critical to addressing the high-risk designation. 

This statement is based on prior reports and testimonies we issued from June 
2007 through February 2012, as well as letters we submitted to DHS in March and 
November 2011 providing feedback on the Department’s January and June 2011 
versions of its Integrated Strategy for High-Risk Management. 5 The statement is 
also based on selected updates we obtained from May 2011 through February 2012. 
For the past products, among other things, we interviewed DHS officials; analyzed 
DHS strategies and other documents related to the Department’s implementation 
and transformation high-risk area; and reviewed our past reports, issued since DHS 
began its operations in March 2003. All of this work was conducted in accordance 
with generally accepted Government auditing standards, and more-detailed informa- 
tion on the scope and methodology from our prior work can be found within each 
specific report. For the updates, we obtained information from DHS on its trans- 
formation and management integration efforts through, among other things: (1) Ob- 
taining the December 2011 version of the Integrated Strategy for High-Risk Manage- 
ment, and (2) meeting with DHS officials, including the Under Secretary for Man- 
agement and Deputy Under Secretary for Management. This statement is also 
based on preliminary observations from our on-going work in response to your re- 
quest to review DHS’s progress in implementing the new IT governance approach. 
For this work, among other things, we are reviewing DHS documentation on its 
planned IT governance process and interviewing DHS officials responsible for imple- 
menting this process. We are conducting this work in accordance with generally ac- 
cepted Government auditing standards. Those standards require that we plan and 
perform the audit to obtain sufficient, appropriate evidence to provide a reasonable 
basis for our findings and conclusions based on our audit objectives. We believe that 
the evidence obtained provides a reasonable basis for our findings and conclusions 
based on our audit objectives. 

DHS HAS UPDATED ITS STRATEGY FOR ADDRESSING ITS HIGH-RISK DESIGNATION 

Since January 2011, DHS has continued to update and strengthen its strategy for 
how the Department plans to address our high-risk designation and resolve its man- 
agement challenges. In January 2011, DHS provided us with its initial Integrated 
Strategy for High-Risk Management, which summarized the Department’s prelimi- 
nary plans for addressing the high-risk area. The January 2011 strategy, which 
DHS later updated in June 2011 and December 2011, was generally responsive to 
the actions and outcomes we identified for the Department to address this high-risk 


3 GAO, Determining Performance and Accountability Challenges and High Risks, GAO-01— 
159SP (Washington, DC: November 2000). 

4 An unqualified opinion states that the financial statements present fairly, in all material re- 
spects, the financial position, results of operations, and cash flows of the entity in conformity 
with generally accepted accounting principles. 

5 See the related products list at the end of this statement. 
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area. Specifically, in our March 2011 written response to DHS’s January 2011 up- 
date, we stated that: 

• the strategy generally identified multiple, specific actions and target completion 
time frames consistent with the outcomes we identified; 

• designated senior officials to be responsible for implementing most actions; and, 

• included scorecards to depict, at a high level, the Department’s views of its 
progress in addressing each high-risk area and a framework for monitoring im- 
plementation of corrective actions through, among other things, quarterly meet- 
ings between DHS and us. 

However, the January 2011 update generally did not discuss the root causes of 
problems. Further, while the strategy identified whether DHS believed it had the 
resources available to implement planned actions, it did not identify what the spe- 
cific resource needs were or what additional resources may be needed, making it dif- 
ficult to assess the extent to which DHS has the capacity to implement those ac- 
tions. 

In June 2011, DHS updated its Integrated Strategy for High-Risk Management. 
The update demonstrated the Department’s continued leadership commitment to ad- 
dress the high-risk designation and represented continued progress. For example: 

• DHS identified 10 root causes that cut across the four management functions 
and management integration. By identifying these root causes, the Department 
better positioned itself to determine corrective actions for addressing the under- 
lying problems that have affected its management implementation efforts, and 
to assess the extent to which progress made in implementing the corrective ac- 
tions has mitigated those underlying problems. 

• DHS organized its corrective actions into 16 key management initiatives (e.g., 
financial management controls, IT program governance, and procurement staff- 
ing model) to address its management challenges and the 31 actions and out- 
comes we identified. 

Identifying key management initiatives should help DHS prioritize its efforts and 
resources for addressing its root causes and management challenges, and provide 
a useful framework for monitoring the Department’s implementation of the initia- 
tives and associated corrective actions. However, elements of the update could be 
strengthened or clarified to better address our high-risk criteria and the actions and 
outcomes we previously identified, including: (1) Better defining the root causes of 
its management problems; (2) clarifying the resources available to implement correc- 
tive actions; (3) consistently reporting the progress of its corrective actions; and (4) 
more clearly and consistently reporting the progress of its key management initia- 
tives. 

DHS provided its most recent update to its strategy in December 2011. Overall, 
we believe that the December update positions the Department to address its man- 
agement challenges and the implementation and transformation high-risk area. For 
example: 

• DHS updated its initiatives — removing two initiatives from the management in- 
tegration area and adding four new initiatives, including human resources in- 
formation technology, management health assessment, strategic sourcing, and 
acquisition workforce development; 6 

• DHS included, for the first time, ratings of the Department’s progress address- 
ing the 31 high-risk outcomes; and: 

• DHS enhanced its reporting and rating methodology for its key management 
initiatives. Specifically, DHS replaced a color-coded (green, yellow, or red) rating 
system used in previous updates with a new system for self-reporting progress. 
DHS now measures and reports its progress addressing the five criteria for re- 
moval from high-risk in two ways. One way uses standard indicators for meas- 
uring progress and a pie graph for reporting such progress across all of its key 
management initiatives against the first four criteria — leadership commitment, 
capacity, corrective action plans, and monitoring. The second way uses specific 
performance measures unique to each initiative for measuring progress and a 
fuel-type gauge for reporting on the fifth criterion — demonstrated progress. Ac- 
cording to DHS, the revised methodology, amongst other things, results in a 
more objective view of each initiative’s progress. 

However, the December 2011 update could be strengthened or clarified to better 
enable DHS and GAO to assess the Department’s progress, in the following ways: 

• More clearly and consistently report the resources available to implement correc- 
tive actions. — DHS identified whether it had sufficient resources to implement 


6 DHS reported eliminating: (1) The policies, procedures, and management directive initiative 
because all of the actions had been completed, and (2) the Department -wide performance man- 
agement initiative because it did not address the high-risk outcomes. 



19 


most of the corrective actions. However, as we also reported to DHS regarding 
the January and June 2011 strategies, for many corrective actions DHS did not 
provide information on what the specific resource needs are or what additional 
resources may be needed to implement the corrective actions. The absence of 
resource information makes it difficult to fully assess the extent to which DHS 
has the capacity to implement these actions, particularly within the time 
frames identified for the corrective actions. 

• Consistently report on corrective actions. — DHS provided information on the De- 
partment’s rationale for eliminating and adding key management initiatives, 
but has not consistently provided such information for the corrective actions it 
established for each initiative. For example, the December strategy contained 
three new corrective actions for the IT program-governance initiative that were 
not in the June 2011 strategy, but did not include three corrective actions that 
had been in the June 2011 strategy. The December strategy did not consistently 
explain the Department’s rationale for eliminating or adding corrective actions 
from the June strategy, such as whether the corrective actions were already 
completed, or if the corrective actions were no longer appropriate or feasible. 
Without consistently providing information on the basis for DHS’s decision to 
add or remove corrective actions, it is difficult for DHS and us to track the sta- 
tus and progress of the Department’s efforts to fully implement its management 
initiatives. 

• Establish measures and report on progress for all initiatives. — DHS established 
a total of 58 measures to track its demonstrated progress in implementing the 
18 initiatives included in the December 2011 strategy. While these measures 
provide additional insight into DHS’s self-reported progress and represent an 
important improvement from the June 2011 strategy, DHS has not yet estab- 
lished measures for one of its initiatives — the new management health assess- 
ment initiative — and did not report on its progress for more than 40 percent (24 
of the 58) of the measures in the December 2011 strategy. Without establishing 
measures and consistently reporting on their progress, neither DHS nor we can 
fully assess the Department’s progress in implementing its initiatives. 

• Stabilize its methodology for measuring progress. — We believe that the en- 
hanced methodology DHS established for assessing its progress in implementing 
its initiatives generally allows for a more objective assessment. However, the 
evolving nature of DHS’s methodology, which the Department revised in the 
June 2011 strategy and again in the December strategy, makes it difficult to 
effectively monitor the Department’s progress over time. 

By strengthening these four aspects, we Believe the December 2011 strategy, if 
implemented and sustained, provides a path for DHS to address our high-risk des- 
ignation. We will continue to closely monitor and assess DHS’s progress in address- 
ing the high-risk designation and the Department’s overall transformation efforts as 
part of our work for the 2013 high-risk update, which we plan to issue in January 
2013. 


DHS HAS MADE PROGRESS, BUT MORE WORK REMAINS TO ACHIEVE HIGH-RISK 

OUTCOMES 

DHS has made progress addressing management challenges and achieving high- 
risk outcomes in some key areas. The Secretary and Deputy Secretary of Homeland 
Security, and other senior officials, have demonstrated commitment and top leader- 
ship support to address the Department’s management challenges. As the following 
examples illustrate, DHS is making progress achieving the long-term goal of en- 
hancing its management capabilities and building a more-integrated Department. 

• In June 2011, we reported that, per Departmental acquisition guidance, DHS’s 
Science and Technology Directorate reviewed and approved test and evaluation 
documents and plans for programs undergoing testing, and conducted inde- 
pendent assessments for the programs that completed operational testing. 7 In 
October 2011, to enhance the Department’s ability to oversee major acquisition 
programs, DHS realigned the acquisition management functions previously per- 
formed by two divisions within the Office of Chief Procurement Officer to estab- 
lish the Office of Program Accountability and Risk Management (PARM). 
PARM, which is responsible for program governance and acquisition policy, 
serves as the Management Directorate’s executive office for program execution 
and works with DHS leadership to assess the health of major acquisitions and 
investments. To help with this effort, PARM is developing a database, known 


7 GAO, DHS Science and Technology: Additional Steps Needed to Ensure Test and Evaluation 
Requirements Are Met, GAO-11-596 (Washington, DC: June 15, 2011). 
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as the Decision Support Tool, intended to improve the flow of information from 
component program offices to the Management Directorate to support its gov- 
ernance efforts. DHS also included a new management initiative in its Decem- 
ber 2011 update (strategic sourcing) to increase savings and improve acquisition 
efficiency by consolidating contracts Department-wide for the same kinds of 
products and services, and reported awarding 14 strategically-sourced contracts 
in fiscal year 2011. We currently have on-going work related to both of these 
areas that we will report on later this year. 8 

• In February 2012, we reported that the DHS Chief Information Officer (CIO) 
and Chief Human Capital Officer were coordinating to streamline and consoli- 
date the Department’s human resources investments. 9 Specifically, in 2010 and 
2011, the DHS CIO conducted program and portfolio reviews of hundreds of IT 
investments and systems. DHS evaluated portfolios of investments within its 
components to avoid investing in systems that are duplicative or overlapping, 
and to identify and leverage investments across the Department. DHS also con- 
solidated: (1) 6 personnel security-related systems into its Department- wide In- 
tegrated Security Management System — with an additional personnel security 
system planned for consolidation in 2012, and (2) two components’ portals into 
the Homeland Security Information Network, with plans to consolidate 12 addi- 
tional portals before 2014. 

• DHS has reduced the number of material weaknesses in internal controls from 
18 since the inception of the Department in 2003 to 5 in fiscal year 2011. 10 In 
addition, in fiscal year 2010 DHS committed to the goal of receiving a qualified 
audit opinion on its consolidated balance sheet in fiscal year 2011 by, for exam- 
ple, remediating financial management issues at the U.S. Coast Guard 
(USCG). 11 In fiscal year 2011, DHS achieved this goal by moving from a dis- 
claimer of opinion to a qualified audit opinion on its balance sheet and state- 
ment of custodial activity for the first time since the Department’s creation. 12 
In its December 2011 strategy, DHS reported plans to expand the audit to all 
financial statements in fiscal year 2012. DHS believes this will identify addi- 
tional areas for corrective action and help it to obtain a clean audit opinion on 
all financial statements by September 2013, although there is no clear plan for 
how full auditability will be achieved. 

• In February 2012, we reported that DHS consolidated five time-and-attendance 
systems into a Department-wide time-and-attendance system and plans to in- 
corporate an additional component by June 2012. 13 This consolidation effort is 
part of DHS’s broader human resources IT initiative. This initiative is intended 
to, among other things: (1) Support the development and implementation of con- 
sistent and consolidated human resources IT systems across DHS, and (2) 
strengthen and unify the Department’s ability to collect and share human re- 
source information. We also reported in February 2012 that DHS had initiated 
a Senior Executive Service Candidate Development Program in May 2011 to 
build its senior leadership pipeline within the Department — consolidating what 
had been four individual leadership programs into a single DHS-wide pro- 


8 We are doing this work at the request of the Senate Committee on Homeland Security and 
Governmental Affairs. Our strategic sourcing work is also being done for the House Committee 
on Oversight and Government Reform. 

9 GAO, Information Technology: Departments of Defense and Energy Need to Address Poten- 
tially Duplicative Investments, GAO-12—241 (Washington, DC: Feb. 17, 2012). 

10 A material weakness is a significant deficiency, or a combination of significant deficiencies, 
in internal control such that there is a reasonable possibility that a material misstatement of 
the entity’s financial statements will not be prevented or detected and corrected on a timely 
basis. A significant deficiency is a deficiency, or combination of deficiencies, in internal control 
that is less severe than a material weakness, yet important enough to merit attention by those 
charged with governance. A deficiency in internal control exists when the design or operation 
of a control does not allow management or employees, in the normal course of performing their 
assigned functions, to prevent, or detect and correct, misstatements on a timely basis. 

11 A qualified opinion states that, except for the effects of the matter(s) to which the qualifica- 
tion relates, the audited financial statements present fairly, in all material respects, the finan- 
cial position, results of operations, and cash flows of the entity in conformity with generally ac- 
cepted accounting principles. The matter(s) to which the qualification relates could be due to 
a scope limitation, or the audited financial statements containing a material departure from 
generally accepted accounting principles, or both. 

12 A disclaimer of opinion states that the auditor does not express an opinion on the financial 
statements (e.g., scope limitations). 

13 GAO, Information Technology: Department of Defense and Energy Need to Address Poten- 
tially Duplicative Investments, GAO-12—241 (Washington, DC: Feb. 17, 2012). 
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gram — and lowered its senior leadership vacancy rates from a peak of 25 per- 
cent in 2006 to 10 percent at the end of fiscal year 20 11. 14 

• In February 2011, we reported that the Department put in place common poli- 
cies, procedures, and systems within individual management functions, such as 
human capital, that help to integrate its component agencies. 15 DHS has also 
demonstrated top leadership commitment by identifying roles and responsibil- 
ities at the departmental level for the key management initiatives it has in- 
cluded in the December 2011 strategy. Additionally, DHS has promoted ac- 
countability for management integration among Department and component 
management chiefs by, among other things, having the Department chiefs pro- 
vide written objectives that explicitly reflect priorities and milestones for that 
management function as well as aligning the component chiefs’ individual per- 
formance plans to the Department’s goals and objectives. 

In its December 2011 strategy, DHS presented detailed plans to address a number 
of management challenges. However, in many instances, DHS has considerable 
work ahead to fully implement these plans and address these challenges. 

• Our prior work has identified challenges related to acquisition oversight, cost 
growth, and schedule delays, including Departmental concerns about the accu- 
racy of cost estimates for some of DHS’s major programs. For example, in June 

2010 we reported that over half of the programs we reviewed awarded contracts 
to initiate acquisition activities without component or Department approval of 
documents essential to planning acquisitions, such as mission need statements 
outlining the specific functional capabilities required to accomplish DHS’s mis- 
sion and objectives; operational requirements; and acquisition program base- 
lines. 16 Additionally, we reported that only a small number of DHS’s major ac- 
quisitions had validated cost estimates. Further, DHS reported in its December 

2011 strategy that senior executives are not confident enough in the data to use 
the Decision Support Tool developed by PARM to help make acquisition deci- 
sions. However, DHS’s plans to improve the quality of the data in this database 
are limited. At this time, PARM only plans to check the data quality in prepara- 
tion for key milestone meetings in the acquisition process. This could signifi- 
cantly diminish the Decision Support Tool’s value because users cannot con- 
fidently identify and take action to address problems meeting cost or schedule 
goals prior to program review meetings. 

• DHS continues to face challenges in managing its IT acquisitions, ensuring 
proper implementation and Department-wide coordination, and implementing 
information security controls. For example, as we reported in 2011, DHS faces 
challenges fully defining key system investment and acquisition management 
policies and procedures for IT. 17 Moreover, the extent to which DHS imple- 
mented these investment and acquisition management policies and practices in 
major IT programs has been inconsistent. We also reported that major IT acqui- 
sition programs were not subjected to executive-level acquisition and invest- 
ment management reviews. As a result, major programs aimed at delivering im- 
portant mission capabilities had not lived up to their capability, benefit, cost, 
and schedule expectations. DHS is currently pilot testing a new approach for 
overseeing and managing its IT acquisitions. We are currently reviewing this 
new governance approach and expect to report the results of our work later this 
year. Further, we previously reported on the need for Federal agencies, includ- 
ing DHS, to improve implementation of information security controls, such as 
those for configuring desktop computers and wireless communication devices. 18 
DHS reports that, as of December 2011, it mostly addressed IT security. How- 
ever, the DHS Office of Inspector General continues to report a material weak- 
ness in this area and identifies information security as a major management 
challenge facing the Department. 

• Due to material weaknesses in internal controls over financial reporting, DHS 
was unable to provide assurance that internal controls over financial reporting 


14 GAO-12-264. 

15 GAO, Department of Homeland Security: Progress Made and Work Remaining in Imple- 
menting Homeland Security Missions 10 Years after 9111, GAO-11-881 (Washington DC: Sept. 
7, 2011); GAO, DHS: A Comprehensive Strategy Is Still Needed to Achieve Management Integra- 
tion Department-wide, GAO-10— 318T (Washington, DC: Dec. 15, 2009). 

16 GAO, Department of Homeland Security: Assessments of Selected Complex Acquisitions, 
GAO-10-588SP (Washington, DC: June 30, 2010). 

17 GAO-11-881. 

18 GAO, Information Security: Federal Agencies Have Taken Steps to Secure Wireless Networks, 
but Further Actions Can Mitigate Risk, GAO— 11-43 (Washington, DC: Nov. 30, 2010); and Infor- 
mation Security: Agencies Need to Implement Federal Desktop Core Configuration Requirements, 
GAO-10—202 (Washington, DC: Mar. 12, 2010). 
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were operating effectively as of September 30, 2011. According to DHS, due to 
existing internal control weaknesses and focus on corrective actions, the audit 
opinion on internal controls over financial reporting will likely remain a dis- 
claimer in fiscal year 2012. DHS also faces challenges in modernizing its finan- 
cial systems. We previously reported that DHS twice attempted to implement 
an integrated Department-wide financial management system, but had not been 
able to consolidate its disparate systems. Specifically, in June 2007, we reported 
that DHS ended its Electronic Managing Enterprise Resources for Government 
Effectiveness and Efficiency effort after determining that the resulting financial 
management systems would not provide the expected system functionality and 
performance. 19 In December 2009, we reported that the Transformation and 
Systems Consolidation program had been significantly delayed by bid protests 
and related litigation. 20 In March 2011, DHS ended this program and reported 
that moving forward it would consider alternatives to meet revised require- 
ments. In 2011, DHS decided to change its strategy for financial system mod- 
ernization. Rather than implement a Department-wide integrated financial 
management system solution, DHS opted for a decentralized approach to finan- 
cial management systems modernization at the component level. Specifically, 
DHS reported in its December 2011 strategy that it plans to replace financial 
management systems at three components it has identified as most in need, in- 
cluding the Federal Emergency Management Agency (FEMA), USCG, and Im- 
migrations and Customs Enforcement (ICE). As of February 2012, DHS officials 
stated that they first planned to modernize FEMA’s system, which would start 
using a Federal shared service provider at the beginning of fiscal year 2015. 
DHS officials told us they had not yet identified the specific approach or nec- 
essary resources and time frames for implementing new systems at USCG and 
ICE. It is not clear whether DHS’s new, decentralized approach to financial sys- 
tem modernization will ensure that component’s financial management systems 
can generate reliable, useful, timely information for day-to-day decision making; 
enhance the Department’s ability to comprehensively view financial information 
across DHS; and comply with related Federal requirements at DHS and its com- 
ponents. We will continue to monitor DHS’s actions in this area. 

• DHS continues to face challenges implementing some of its key human capital 
initiatives and functions. For example, the DHS Chief Information Officer’s 
(CIO) September 2011 assessment of the human resources IT program identi- 
fied two risks that could have adverse effects on the cost and schedule of the 
program. First, if the program is unable to meet its established baseline sched- 
ules, there is a high probability of program breach and potential loss of funding 
due to lack of prioritization. Second, if a thorough understanding of existing leg- 
acy applications and processes across the DHS components is not achieved, the 
new, consolidated system will not adequately replace existing functionality nor 
provide the stable operational functionality needed from the program. DHS has 
also struggled with low job satisfaction among its employees since its inception. 
For the 2011 Federal Employee Viewpoint Survey, DHS scored below the Gov- 
ernment-wide average on the Office of Personnel Management’s Job Satisfaction 
Index and ranked 31st of 33 Federal agencies on employee satisfaction, accord- 
ing to the Partnership for Public Service’s analysis of the survey results. At the 
subcommittee’s request, we currently have work underway evaluating the effec- 
tiveness of DHS’s plans and efforts to address its employee morale issues and 
expect to report our findings later this year. Further, in June 2011, DHS re- 
ported that it was developing component operational plans to implement its De- 
partment-wide workforce strategy and align the component plans with the 
goals, measures, and objectives of the strategy. However, in its December 2011 
strategy, DHS reported that it had not finished providing feedback to compo- 
nents on their fiscal year 2011 plans. 

• DHS needs to continue to demonstrate sustainable progress in integrating its 
management functions within and across the Department and its components 
and take additional actions to further and more effectively integrate the Depart- 
ment. Specifically, in its January 2011 high-risk strategy, DHS described plans 
to establish an Integrated Investment Life Cycle Model (IILCM) for managing 
investments across its components and management functions; strengthening 
integration within and across those functions; and ensuring mission needs drive 
investment decisions. This framework seeks to enhance DHS resource decision 


19 GAO, Homeland Security: Department-wide Integrated Financial Management Systems Re- 
main a Challenge, GAO— 07-536 (Washington, DC: June 21, 2007). 

20 GAO, Financial Management Systems: DHS Faces Challenges to Successfully Consolidating 
Its Existing Disparate Systems, GAO-10-76 (Washington, DC: Dec. 4, 2009). 
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making and oversight by creating new department-level councils to identify pri- 
orities and capability gaps, revising how DHS components and lines of business 
manage acquisition programs, and developing a common framework for moni- 
toring and assessing implementation of investment decisions. DHS reported in 
December 2011 that the IILCM initiative had made little progress since Janu- 
ary 2011 though the Department planned to begin using the IILCM by the end 
of September 2012. The Department also indicated it had not determined re- 
source needs to accomplish any of the eight associated corrective actions it has 
identified for this initiative. 

While DHS has made progress, the Department still faces considerable challenges. 
Going forward, DHS needs to continue implementing its Integrated Strategy for 
High-Risk Management and show measurable, sustainable progress in implementing 
its key management initiatives and corrective actions and achieving outcomes. We 
will continue to monitor and assess DHS’s implementation and transformation ef- 
forts through our on-going and planned work, including the 2013 high-risk update 
that we expect to issue in early 2013. 

Chairman McCaul, Ranking Member Keating, and Members of the subcommittee, 
this concludes my prepared statement. I would be pleased to respond to any ques- 
tions that you may have. 

Mr. McCaul. Thank you Mr. Maurer for your testimony. 

The Chairman now recognizes Mr. Edwards for his testimony. 

STATEMENT OF CHARLES K. EDWARDS, ACTING INSPECTOR 
GENERAL, U.S. DEPARTMENT OF HOMELAND SECURITY 

Mr. Edwards. Good morning, Chairman McCaul, Ranking Mem- 
ber Keating, and distinguished Members of the subcommittee. 

Thank you for inviting me today to testify about the integration 
of information across the Department, specifically in the areas of 
financial and acquisition management. 

The Department achieved a significant milestone in the area of 
financial management in fiscal year 2011. For the first time since 
2003, DHS was able to produce an auditable balance sheet and a 
statement of custodial activity. The independent auditors rendered 
a qualified opinion on those financial statements. 

Nevertheless, the Department still has much work to do. The 
independent auditors were unable to perform procedures necessary 
to form an opinion on DHS internal control of financial reporting 
on fiscal year 2011 balance sheet and the statement of custodial ac- 
tivity. As part of the fiscal year 2011 audit, the independent audi- 
tors identified a pervasive financial system functionality limitation 
at all of the significant DHS components. 

The Department’s financial information technology system infra- 
structure is aging and has limited functionality, which is hindering 
the Department’s ability to implement efficient corrective actions 
and produce reliable financial statements. The auditors noted that 
many of the financial systems in use at DHS components have 
been inherited from legacy agencies and have not been substan- 
tially updated since DHS’s inception. 

As a result, on-going financial system functionality limitations 
are contributing to the Department’s challenges in addressing sys- 
temic internal control weaknesses and strengthening the overall 
control environment. Since 2003, the Department has made several 
efforts to consolidate its component financial systems. 

Most recently, the Department cancelled a solicitation for the 
transformation and system consolidation, or TASC, program in 
May 2011. We have communicated with the Department regarding 
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its plans for the modernization of its financial systems, and we will 
begin a review of its new efforts later this month. 

With respect to acquisition management, acquisitions consume a 
significant part of DHS’s annual budget and are fundamental to 
the Department’s ability to accomplish its mission. In April 2011, 
we published an audit report regarding DHS oversight of compo- 
nent acquisition programs. In that report, we found that the De- 
partment needs to provide additional guidance and improved con- 
trols in some areas. One of the areas that we targeted for improve- 
ment concerned the use of the Next Generation Periodic Reporting 
System, or nPRS. 

nPRS is an integrated system that provides visibility to the De- 
partment to track component acquisition investments. Component 
personnel are responsible for entering and updating information in 
nPRS, including cost, budget, performance, and scheduled data. As 
a result of our audit, we determined that the Department has 
issued conflicting guidance and enforcement for reporting in nPRS 
since the system became operational in 2008. 

For the 17 acquisition programs to be reviewed during our audit, 
we found that components were not completing and reporting all 
key information in nPRS. We found some other inconsistencies dur- 
ing our audit. Not all of the 86 programs identified by the Depart- 
ment on its list of major acquisition programs were reported in 
nPRS by components. When we questioned the Department per- 
sonnel about the differences between the list of major acquisition 
programs and nPRS, they stated that the differences were due to 
timing issues. 

However, we were not able to reconcile the differences to verify 
that they were timing-related. Our audit report recommended that 
the Department mandate the use of nPRS for all acquisition pro- 
grams and issue improved guidance regarding nPRS reporting. The 
chief procurement officer agreed with our recommendation and 
stated that by April 30, 2011, it would issue guidance to compo- 
nents to require inclusion of all level 1, 2, and 3 acquisition pro- 
grams within the nPRS tracking tool. We are continuing to monitor 
the implementation of this recommendation. On February 16, 2012, 
we received the Department’s latest update. In that update, the 
Department stated that it was integrating its components to ensure 
that all acquisition programs are recorded accurately in nPRS on 
a monthly basis. 

While we are encouraged by the Department’s actions, this effort 
does not meet the full intent of our recommendation that the use 
of nPRS is mandated across the Department. 

Chairman McCaul, this concludes my prepared remarks, and I 
would be happy to answer any questions that you or other Mem- 
bers may have. Thank you. 

[The statement of Mr. Edwards follows:] 

Prepared Statement of Charles K. Edwards 
March 1, 2012 

Good morning Chairman McCaul, Ranking Member Keating and distinguished 
Members of the subcommittee: I am Charles K. Edwards, Acting Inspector General 
of the Department of Homeland Security (DHS). Thank you for inviting me to testify 
today about the integration of information across the Department, specifically in the 
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areas of financial management, acquisition management, and human capital man- 
agement. 

As you know, the DHS Office of Inspector General (OIG) was established in Janu- 
ary 2003 by tbe Homeland Security Act of 2002 by amendment to the Inspector 
General Act of 1978. The DHS OIG seeks to promote economy, efficiency, and effec- 
tiveness in DHS programs and operations and reports directly to both the DHS Sec- 
retary and the Congress. We fulfill our mission primarily by issuing audit, inspec- 
tion, and investigative reports that include recommendations for corrective action, 
and by referring cases to the United States Attorney General for prosecution. 

I am pleased to have the opportunity to testify about two of our audit reports 
today. My testimony will focus on the areas of financial management and acquisi- 
tion management. 

I will describe some of the challenges facing DHS, the steps DHS has taken and 
its progress in addressing those challenges, as well as provide details regarding fur- 
ther improvements the Department can make. 

FINANCIAL MANAGEMENT 

In an effort to reduce redundancy, weaknesses, and vulnerabilities in its financial 
systems, DHS has made several attempts to consolidate its financial systems since 
the Department’s creation. 

The first attempt, known as the Electronically Managing Enterprise Resources for 
Government Effectiveness and Efficiency project, was canceled in December 2005, 
due to technical challenges in the integration efforts. The second attempt, a task 
order issued in August 2007, for a solution architect to develop and implement a 
new system under the Enterprise Acquisition Gateway for Leading Edge Solutions 
contract ended when no bids were received. The third attempt, called Trans- 
formation and Systems Consolidation (TASC) Baseline, focused on moving DHS 
components to one of two financial systems platforms: SAP or Oracle. On March 17, 
2008, the TASC baseline approach ended when a Federal court ruled against DHS 
in the court case of Savantage Financial Services, Inc. vs. United States. The court 
ruled that DHS’ decision to use Oracle and SAP financial software systems via 
“Brand Name Justification” was an improper sole source procurement in violation 
of the Competition in Contracting Act. 

In May 2008, the TASC initiative was revised to acquire an integrated financial, 
acquisition, and asset management solution for DHS. This approach was a larger 
effort than DHS had attempted previously because it attempted to not only consoli- 
date component financial systems but also to implement DHS-wide asset manage- 
ment and procurement systems. TASC was a Department-wide effort co-sponsored 
by the DHS Under Secretary for Management (USM) and the Chief Financial Offi- 
cer. 

In January 2009, the TASC program issued a RFP for a vendor to integrate, test, 
deploy, manage, operate, and maintain the transformed business processes and 
services of an integrated financial acquisition and asset management solution for 
DHS. In July 2010, we issued an audit report, DHS Needs to Address Challenges 
to Its Financial Systems Consolidation Initiative. The objective of our audit was to 
determine whether DHS was making progress in developing and implementing the 
TASC initiative. Our audit report included five recommendations; the Department 
concurred or partially concurred with all five. Subsequently, in May 2011, the De- 
partment announced that it was cancelling the solicitation for the TASC program 
and was considering alternatives to meet revised requirements. We understand that 
the Department is considering options, and we will continue to be in communication 
with the Department regarding its plans. 

Although the Department has not completed the modernization and consolidation 
of its financial systems, it continued to improve financial management in fiscal year 
2011 and achieved a significant milestone. For the first time since 2003, the Depart- 
ment was able to produce an auditable balance sheet and statement of custodial ac- 
tivity and the independent auditors rendered a qualified opinion on those financial 
statements. Nevertheless, the Department still has much work to do. The inde- 
pendent auditor was unable to perform procedures necessary to form an opinion on 
DHS’ internal control over financial reporting of the fiscal year 2011 balance sheet 
and statement of custodial activity. 

The independent auditors identified pervasive financial system functionality limi- 
tation at all of the significant DHS components. The Department’s financial infor- 
mation technology system is aging and has limited functionality, which is hindering 
the Department’s ability to implement efficient corrective actions and produce reli- 
able financial statements. The auditors noted that many of the financial systems in 
use at DHS components have been inherited from the legacy agencies and have not 
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been substantially updated since DHS’ inception. As a result, on-going financial sys- 
tem functionality limitations are contributing to the Department’s challenges in ad- 
dressing systemic internal control weaknesses and strengthening the overall control 
environment. 


ACQUISITION MANAGEMENT 

Background, 

Acquisitions consume a significant part of the Department of Homeland Security’s 
annual budget and are fundamental to the Department’s ability to accomplish its 
mission. In fiscal year 2010, DHS awarded over $13 billion for more than 88,000 
procurement actions. 

The USM is responsible for the overall DHS acquisition process. As the Depart- 
ment’s Chief Acquisition Officer, the USM is responsible for managing, admin- 
istering, and overseeing the Department’s acquisition policies and procedures. The 
USM delegates the responsibility for effective Department-wide procurement policies 
and procedures, including procurement integrity, to the Chief Procurement Officer 
(CPO). The Office of the CPO (OCPO) is responsible for oversight of most DHS ac- 
quisition activities and services, including management, administration, and stra- 
tegic sourcing. OCPO responsibilities also include developing and publishing Depart- 
ment-wide acquisition regulations, directives, policies, and procedures. 

The USM also delegates the responsibility for developing and implementing the 
governance processes and procedures for program management over DHS’ various 
acquisition programs to the Acquisition Program Management Division (APMD), 
now called the Program Accountability and Risk Management Office. Separation of 
the OCPO procurement management responsibilities for acquiring goods and serv- 
ices and APMD’s program management of the acquisition process provides a layered 
approach to DHS’ acquisition oversight. 

STEPS TAKEN BY DHS TO IMPROVE ITS ACQUISITIONS MANAGEMENT 

In 2003, the Government Accountability Office (GAO) designated implementing 
and transforming the Department of Homeland Security as high-risk. 1 GAO stated 
that the Department’s efforts to integrate 22 independent agencies into a single de- 
partment was an “enormous undertaking,” partly because many of the major compo- 
nents faced at least one management problem, including financial management 
vulnerabilities. In a 2011 update, GAO noted that acquisition management weak- 
nesses have prevented major programs from meeting capability, benefit, cost, and 
schedule expectations. 2 To address management challenges, GAO recommended 
“validating key acquisition documents during the acquisition review process.” 3 

In September 2005, we published a report identifying significant weaknesses that 
threatened the integrity of the Department’s procurement and program manage- 
ment operations. 4 We made five recommendations to address the vulnerabilities in 
the Department’s acquisition operations. DHS concurred with all five recommenda- 
tions and agreed to move ahead with expanded procurement ethics training, en- 
hancement of oversight, and establishment of a Departmental program management 
office to address procurement staff shortages and staff authority. Since our 2005 re- 
port, DHS has implemented management directives and organizational changes, 
and developed acquisition training programs intended to identify inefficiencies in 
the acquisition process and prevent procurement ethics violations. 

In November 2008 — recognizing the continued increase in the quantity and com- 
plexity of DHS acquisitions — the Chief Acquisition Officer classified acquisitions into 
three levels to define the extent and scope of required project and program manage- 
ment and the specific official who serves as the Acquisition Decision Authority. For 
level 1 acquisitions (greater than or equal to $1 billion), the Acquisition Decision 
Authority is at the Deputy Secretary level. For level 2 acquisitions, ($300 million 
or more, but less than $1 billion), it is the Chief Acquisition Officer. For level 3 ac- 
quisitions (less than $300 million), the Acquisition Decision Authority is at the Com- 
ponent Head level. Acquisition Management Directive 102-01, Revision No. 1 (Di- 


1 GAO— 03-119, High-Risk Series: An Update (Jan. 2003). GAO maintains a program to iden- 
tify Government operations that are high-risk due to greater vulnerabilities to fraud, waste, 
abuse, and mismanagement or the need for transformation to address economy, efficiency, or 
effectiveness. Since 1990, GAO has designated over 50 areas as high-risk and subsequently re- 
moved over one-third of the areas due to progress made. 

2 GAO-ll-278, High-Risk Series: An Update (Feb. 2011), p. 93. 

3 Id., 33-34. 

4 OIG— 05-53, Department of Homeland Security’s Procurement and Program Management Op- 
erations (Sept. 2005). 
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rective 102-01), also identifies specific alternate Acquisition Decision Authorities for 
each level. 

While the Department has taken these and other significant steps to improve its 
acquisition oversight processes and controls, our report OIG-11-71, DHS Oversight 
of Component Acquisition Programs (April 2011) identified additional areas for im- 
provement, including improved guidance to components regarding their use of the 
next Generation Periodic Reporting System (nPRS), an integrated system that pro- 
vides visibility to the Department to track components’ level 1, 2, and 3 acquisition 
investments. 


ADDITIONAL GUIDANCE NEEDED FOR USE OF NPRS 

In DHS Oversight of Component Acquisition Programs, we recognized that the De- 
partment has made improvements to its acquisition oversight processes and controls 
through implementation of a revised acquisition management directive. However, 
the Department needs to provide additional detailed guidance and improve controls 
in some areas. One of the areas we identified for improvement is the use of nPRS, 
an integrated system that provides visibility to the Department to track compo- 
nents’ level 1, 2, and 3 acquisition investments. It can also store working and ap- 
proved key acquisition documents, earned value management information, and risk 
identification. Component personnel are responsible for entering and updating infor- 
mation regarding their acquisition programs in nPRS. This information includes, 
but is not limited to, cost, budget, performance, and schedule data. 

Since nPRS became operational in 2008, tbe Department has issued conflicting 
guidance and enforcement for reporting level 1, 2, and 3 acquisition programs. Ac- 
cording to APMD personnel, level 1 and 2 acquisition programs are the only pro- 
grams that require nPRS reporting, while reporting level 3 acquisition programs is 
optional. Despite APMD personnel’s explanation of the nPRS reporting require- 
ments, in November 2008 they required level 1, 2, and 3 acquisitions to follow the 
DHS periodic reporting process identified in the nPRS manual. Then in May 2009, 
the USM issued a memorandum requiring major acquisition programs, level 1 and 
2, to transition to nPRS by the end of the month. In July 2009, the Office of the 
Chief Information Officer issued guidance that required components to report all 
programs to nPRS. In September 2009, the Director of APMD issued a memo- 
randum designating nPRS as the Department’s system of record for acquisition 
management data and official reporting system for all level 1, 2, and 3 acquisition 
programs. In January 2010, the APMD issued the final Directive 102-01, which re- 
quired all level 1, 2, and 3 acquisition programs to comply with the DHS periodic 
reporting process. This conflicting verbal and written guidance confused component 
personnel, who were not sure whether to report all acquisition programs or only 
level 1 and 2 programs. 

In May 2010, the USM issued a list of major acquisition programs that identified 
86 level 1 and 2 acquisition programs and elevated some level 3 acquisition pro- 
grams for Departmental oversight. According to APMD personnel, the Department 
and components jointly create the major acquisition program and project list. The 
APMD obtains information from nPRS and requests updated information from the 
components regarding their current number of acquisition programs. Once APMD 
personnel receive the information, they create the final list and the USM signs and 
issues the new list. 

As of July 2010, we identified six acquisition programs listed on the USM letter, 
but components did not report them in nPRS. We also identified five level 1 and 
2 acquisition programs reported in nPRS but not on the USM letter. When we ques- 
tioned Department personnel about the differences between the USM letter and 
nPRS, they stated that the differences were due to timing issues. However, we were 
not able to reconcile the differences to verify that they were timing related. Table 
1 compares the list of acquisition programs in the May 2010 USM memo with the 
nPRS database as of July 2010. 

TABLE 1.— ACQUISITION PROGRAM REPORTING SYSTEM 
INCONSISTENCIES 


USM Memo— May 2010 


nPRS Database — July 2010 


Consolidated Mail System Program No Entry. 

Electronic Records Management System No Entry. 

St. Elizabeth’s No Entry. 

National Security System Program No Entry. 

Online Tracking Information System No Entry. 
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TABLE 1.— ACQUISITION PROGRAM REPORTING SYSTEM 
INCONSISTENCIES— Continued 


USM Memo— May 2010 


nPRS Database — July 2010 


Federal Protective Services 
No Entry 

No Entry 

No Entry 

No Entry 

No Entry 


No Entry. 

Critical Infrastructure Technology and 
Analysis. 

CBP — Infrastructure. 

FEMA — Infrastructure. 

ICE — Infrastructure. 

USSS — Infrastructure. 


To identify the number of acquisition programs in the Department, we requested 
a list of all programs from nPRS, but the Department could provide only level 1 and 
2 acquisition programs. In March 2010, we requested that the components provide 
us with a list of all level 1, 2, and 3 acquisition programs so we could gain a com- 
plete inventory of acquisition programs throughout the Department. Table 2 shows 
some inconsistencies between the Department’s totals and the components’ totals. 

TABLE 2.— ACQUISITION PROGRAM INCONSISTENCIES 


Department 

Level 1 

Level 2 

Level 3 

Total 

USM Letter — Apr 23, 2009 

42 

25 

0 

67 

nPRS datapull March 2010 

43 

20 

0 

63 

USM Letter — May 26, 2010 

46 

40 

0 

86 

nPRS datapull June 2010 

49 

33 

0 

82 

nPRS datapull July 2010 

50 

32 

70 

152 

COMPONENTS 

48 

22 

152 

222 


We obtained the Department’s totals at five different times. Though we under- 
stand that there may be differences in timing due to the intervals, the Department 
needs to make sure that components are consistently reporting all acquisition pro- 
grams into the standard system. In July 2010, we obtained our last data from nPRS 
that showed progress regarding the number of level 3 acquisition programs compo- 
nents entered in the system. However, at the time of the publication of our report, 
nPRS still did not reflect half of the total number of level 3 programs components 
reported outside nPRS. 


USE OF NPRS BY COMPONENTS 

Because the Department has not ensured or mandated that components use 
nPRS, some components have developed systems comparable to nPRS. According to 
APMD personnel, nPRS allows components to create a copy of nPRS software and 
integrate it to meet their needs. The copy, which is called the nPRS Sandbox, allows 
the components to duplicate the nPRS software and to use the already developed 
nPRS as their oversight tool for draft documents and approval of documentation and 
earned value management, as well as cost and schedule status. The component’s 
Sandbox copy of nPRS is not visible by DHS headquarters or other components be- 
cause nPRS restricts access to authorized users. As of July 2010, Transportation Se- 
curity Administration (TSA), the Federal Emergency Management Agency (FEMA), 
and the DHS Chief Financial Office had requested use of the nPRS Sandbox feature. 

Component personnel have developed, or are in the process of developing, their 
own data-tracking systems because the Department has not consistently mandated 
use of nPRS or its tools. For example: 

• TSA hired and spent approximately $100,000 for a contractor in 2005 to develop 
the TSA Acquisition Program Status Report, which served as its data-tracking 
system. As of June 2010, TSA had merged its acquisition program portfolio, lev- 
els 1, 2, and 3, into nPRS and will no longer use the TSA Acquisition Program 
Status Report. As of August 2010, nPRS is TSA’s official tracking system for 
acquisition programs. 

• FEMA, Customs and Border Protection (CBP), Immigration and Customs En- 
forcement, and U.S. Secret Service use internally-developed systems based on 
software programs such as Microsoft SharePoint. 

• CBP personnel were in the process of developing an additional database to 
track acquisitions throughout the Acquisition Lifecycle Framework. We were 
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not able to determine the cost of this tracking database. According to CBP per- 
sonnel, the database development was a verbal agreement between CBP per- 
sonnel and the contractor. The statement of work under which the contractor 
was performing other work for CBP did not contain any mention of the verbal 
agreement. 

In summary, the Department does not always know what is in its acquisition 
portfolio because of the conflicting written and verbal guidance provided to the com- 
ponents. The USM has not ensured that components report all level 1, 2, and 3 ac- 
quisition programs in nPRS, which hinders its ability to have complete visibility 
into component acquisition programs. By mandating use of nPRS for all acquisition 
programs, the USM would have visibility into components’ acquisition programs and 
could provide better oversight for its acquisition portfolio. 

We recommended that the Department direct components to report all acquisition 
programs (levels 1, 2, and 3) to nPRS. The Chief Procurement Officer agreed with 
our recommendation and stated that by April 30, 2011 it would issue guidance to 
components to require inclusion of all level 1, 2, and 3 acquisition programs within 
the nPRS tracking tool. We are continuing to monitor this recommendation and it 
remains resolved and open. On February 16, 2012, we received the Department’s 
latest update. In that update the Department stated that it was encouraging its 
components to ensure that all acquisitions program information is reported accu- 
rately monthly. While we are encouraged by the Department’s actions, this effort 
does not meet the full intent of our recommendation. 

Chairman McCaul, this concludes my prepared remarks. I would be happy to an- 
swer any questions that you or the Members may have. Thank you. 

Mr. McCaul. Thank you, Mr. Edwards. 

I understand we will be voting probably in 15 to 20 minutes. We 
are going to keep the 5-minute rule very tightly. The 9/11 Commis- 
sion basically said that 9/11 was a result of a failure of imagina- 
tion. We can imagine many threats out there. When we have failed 
programs and we see taxpayer dollars wasted, that is not only a 
management issue; it is an issue that puts the American people 
more at risk. It is an issue that prohibits the Department from 
doing its core mission, and that is protecting the homeland. 

It is not hard to imagine a nuclear threat. When we look at the 
situation in Iran with Israel and Iran getting closer to having a nu- 
clear capability, when we see Iran’s relationship with Venezuela 
and Cuba, Hezbollah in the Western Hemisphere, Hezbollah in 
Mexico, Hezbollah in the United States, and yet we had a program, 
a nuclear detection program, the ASP, that totally failed; $230 mil- 
lion of taxpayer dollars wasted. We had a program, SBInet, a bor- 
der security program; $1 billion, nearly $1 billion, wasted. In the 
private sector, if that occurred, people would be held accountable. 
In the private sector, a business would be accountable to their 
shareholders. They would be accountable to the Federal regulators. 
They would be accountable to the Justice Department. Yet here are 
just two examples of tremendous failures that in my judgment put 
the American people more at risk to a nuclear attack across our 
Southwest Border and yet no one was held accountable. There was 
no accountability. 

It is not just about management; it is about American lives at 
stake. So that is how I see this issue. It is an issue of integration. 
You have 22 different departments merged into one giant agency. 

Mr. Borras, I know you have a great challenge on your hands, 
and you inherited a lot of this, and it is very difficult to merge 22 
agencies. But when they are stovepiped by acquisition and procure- 
ment and they are not integrated, we see these failures. Again, ra- 
diation detection ASP, $230 million of taxpayer money; SBInet $1 
billion. Again, it is not some glazed-over management issue. This 
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puts American lives at stake to a nuclear threat that exists, that 
is real. Not only the nuclear threat but the border, which coming 
from the State of Texas, I view as a tremendous threat to our secu- 
rity. So, with that, Mr. Borras, if you would explain to me what 
happened with the ASP program; what happened, and was any- 
body held accountable within the Department? 

Mr. Borras. Mr. Chairman, certainly both the SBI program and 
the ASP, as well as other programs, were highly informative cer- 
tainly to me when I came in. SBInet was initiated in 2006; ASP 
shortly thereafter. As we now know, the Secretary called a halt to 
the SBI program to take a look at the factors that went into the 
cost overruns and the lack of good requirements. Similarly, with 
ASP, in April 2011, we had an acquisition review board meeting 
where we reviewed the progress and the lack of success with ASP, 
and we directed that that program be ended, the contract not be 
extended. 

What I am saying to you, Mr. Chairman, is that those programs 
in the past suffered from the lack of oversight. There was no mech- 
anism to review, back in 2006-2007, departmental programs. What 
we have put in place, which I have described and my colleagues 
have acknowledged exist, is now we have a robust acquisition re- 
view process. We are using information-gathering tools like the 
DST to be able to now monitor much more closely the project proc- 
ess and the progress of a program. But it is not just catching pro- 
grams when they fail. Because we have to manage these invest- 
ments, it is very important that we maintain the sustainability of 
a program, so we have to increase its probability of success while 
reducing its risk. 

So now we have a mechanism, and we have documented over the 
last 2 years over 70 instances where we have called programs be- 
fore the Department, where they are subject to a comprehensive re- 
view, and as a result of these reviews they have been giving adjust- 
ments, modifications, in some programs like ASP, they have been 
told to cease. They have been told to perform other functions to 
modify their process to improve the success of those programs. So, 
Mr. Chairman, I will say to you that we are far from perfect, but 
we are much better stewards of the investment dollars today than 
we were back in 2006-2007. 

Mr. McCaul. Well, I certainly hope so. Was anybody held ac- 
countable for these failures? 

Mr. Borras. Both of those programs were initiated certainly be- 
fore my time at the Department, so I am not aware or cognizant 
of any action that was taken prior to my arrival in 2010. 

Mr. McCaul. I just think too often — you know, I was in the Jus- 
tice Department for a decade, but I think too often, the Federal 
Government, when failures like this are made, nobody is held ac- 
countable. You know, if this was in the private sector again, a pri- 
vate company, corporation, heads would have rolled over this thing, 
and yet I don’t see any accountability here. I mean, I applaud your 
efforts to transform the agency. You have a great task in front of 
you. But it is this accountability issue that seems to be lacking in 
my judgment. 

Finally, and I have to move on very quickly, but Mr. Maurer or 
Mr. Edwards, do you have any thoughts on this issue in terms of 
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what needs to be done to prevent these failures from occurring 
again? 

Mr. Maurer. I think the first thing the Department needs to do 
is execute the plans that it has already put in place. That tradi- 
tionally has been a challenge DHS has faced from the time it was 
stood up. They have had plans to address IT and human capital 
and acquisition from the time it was created in 2003. They haven’t 
always executed on those plans. So I think that is sort of the first 
thing going forward. 

I think the second thing going forward is accountability. As you 
correctly point out, Mr. Chairman, it is important to have account- 
ability and oversight of these on-going efforts, and we have been 
working very closely with DHS in this regard and will continue to 
do so. 

Mr. McCaul. Just very briefly, Mr. Edwards. 

Mr. Edwards. The Department has matured the initiative focus- 
ing on keeping the public safe. Most of the resources were dedi- 
cated to that. Now they are focusing on improving management 
control standardizing policies, procedures, and developing systems 
to integrate. I think this is a huge monumental task, and the De- 
partment is making progress and moving in the right direction. 

Mr. McCaul. Let me just close by saying I think the Department 
of Defense had a lot of growing pains. The Goldwater-Nichols plan, 
I think, you should be looking at. Finally, I come from Austin, 
where there is a lot of technology. I really think technology can be 
your best friend in terms of integration. I do applaud your efforts 
to bring in the cloud, where you have the 22 different agencies in- 
tegrated through technology. But with use of the cloud, I think that 
could really move the Department forward into the right direction. 
With that, I now recognize the Ranking Member. 

Mr. Keating. Thank you, Mr. Chairman. 

We are running out of time, so I will go to what my prepared 
questions are. 

Mr. Edwards, when you laid out the success of the qualified 
audit and you laid out what there should be done, does your review 
also look forward in terms of what resources are there, what the 
cost of those resources, what the Department doesn’t have at its 
disposal to do it and what the cost figures were to do it, instead 
of just here is the Department’s responsibilities, this is where they 
have to go? Do you also say that they don’t have the resources 
available to do this and what the cost of that would be for the De- 
partment to do that? 

Mr. Edwards. No, sir, we have not done that. We have just 
looked at because the — you know, the number of 22 agencies com- 
ing together with legacy systems. 

Mr. Keating. Okay. I just wanted to qualify this. It is great to 
say, here is what the Department should do. What I think we need 
as well is a better understanding of, where are they going to get 
the resources to get this done? I will turn that to Mr. Maurer, the 
same thing. When you are reviewing this, I know that you can turn 
it back and say, well, that is your job, Congressman, to give the 
resources. That being said, we could use a roadmap here in Con- 
gress because these are issues of security and the safety of the pub- 
lic. 
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So, Mr. Maurer, do you think that is a better approach to not 
only say what is not done, but to say the resources that are nec- 
essary to do it include these kind of resources? Because doing — we 
are all doing less — we all are trying to do more with less resources, 
but these are issues of National security and, in the long run, could 
be cost-effective if we could do a better job of providing those man- 
agement resources. 

Mr. Maurer. Absolutely. We certainly agree that investing in 
management resources is key to the Department’s overall success 
in achieving its key missions. One of the things that we are looking 
at when we assess the various Department plans for addressing 
our high risk is their own assessment of the resources that they 
say they need to carry out what they plan to do. We have had some 
questions along those lines about whether or not they have the 
ability to put the resources to bear to actually execute on these 
plans. 

Mr. Keating. That will lead in, and I am just going to do a 
three-part one question because of the time. So, Mr. Borras, getting 
right to you, going down the line here, I think the starting point 
we all acknowledge for homeland security was a very difficult one. 
One quick question and then just react to the question I ask about 
resources that are necessary. I am curious, what you control for all 
of DHS, how much of that is under your direct budget, how much 
isn’t? 

Mr. Borras. Well, Congressman, the way the budget is organized 
the Under Secretary has authority for the good stewardship of the 
entire budget spent through the financial, including the way that 
we are organized the components have authority in the way that 
Congress has set up the funding for those organizations. They 
aren’t under the control of the component heads. But as it relates 
to the resources, and we have put together plans that show the re- 
source requirements needed to implement many of these initia- 
tives, I will tell you, I have tried to be very frugal, very mindful 
of the financial state that we currently exist in. I have not asked 
for any significant increases in our budget. We are attempting to 
use, as the Chairman mentioned, leverage technology, our existing 
resources. It is often a challenge because oftentimes, we are pitted 
against each other; do we invest in the management backbone of 
the Department, or do we invest in the operations of the Depart- 
ment? Clearly the Secretary has made it clear she is not going to 
sacrifice the operations of the Department. So we are trying to do 
the best we can with the resources we have available and 
leveraging technology. 

Mr. Keating. With the focus of today’s hearing and coming years 
ago from my MBA perspective on things, I honestly think that we 
should really look carefully. One of the outcomes of this hearing 
should be, are we investing enough in management resources, so 
you are not in this situation, well, here is operations, here is man- 
agement; we don’t have enough to do both. Well, if you don’t have 
good tools to manage then that operational budget is not going to 
be used as efficiently as possible. So my thinking is, too, that all 
too often, we just keep looking at what we have to do to get by, 
and that is important in tough times. But we are losing the oppor- 
tunity to save money and be more efficient in the long run and to 
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do a better job and to meet these requirements that Mr. Edwards 
talked about, Mr. Maurer talked about, and getting the job done. 
Sometimes not investing up front is going to cost you more down 
the road, and that that not only is a cost in dollars; it is a cost in 
safety. That is what I would like to see more of a focus upon. 

Mr. McCaul. I thank the Ranking Member. 

The Chairman now recognizes the gentleman from Pennsylvania, 
Mr. Marino. 

Mr. Marino. Thank you, Chairman. 

Gentlemen, thank you for being here. I do not have any ques- 
tions, but I do have a brief statement to make. First of all, I want 
to thank you for stepping up to the plate and assuming these roles 
and your staff as well. It is an awesome responsibility. You have 
thousands and thousands of people just in the agency alone for 
whom you are responsible and of course responsible to the citizens 
of the United States. 

No one forced you to take these positions. What I am tired of 
hearing since I have been here the last year and 2 months is, I in- 
herited a mess, okay. None of you have said that, and I applaud 
you for not saying that. But again, you assumed the responsibility. 
Now the ball is in your court. You have to make this agency the 
best security agency in the world and the most efficient. 

You have an awesome responsibility. But we are going to be 
watching. We are going to assist you wherever we are able to do 
it, keeping in mind that we have a finite amount of dollars and an 
infinite amount of problems. So I leave you with good luck. If my 
office or any of us can be of any assistance to you, please don’t hesi- 
tate to contact us. 

But the next time we are talking, it is your responsibility now 
to get this agency where it should be. Thank you. 

I yield back my time. 

Mr. McCaul. I thank the gentleman for your comments. 

I wholeheartedly agree with what you just said. I think too often, 
we get into gotcha politics in the Congress. Our sincere effort is 
to — this is too important to the American people, the mission. 

So we are here really to help you. Mr. Marino served as United 
States attorney for many years, and I was in the Justice Depart- 
ment for many years. The Ranking Member was a district attorney. 
We certainly understand, coming from the Government’s perspec- 
tive, where you are, and so we do want to help you. 

Mr. Marino. Can I just 

Mr. McCaul. I yield to Mr. Marino. 

Mr. Marino [continuing]. Qualify it with one thing. No one 
forced me to run for Congress either, and I took on this responsi- 
bility. It is mine now; it is ours. So we are sort of in the same boat. 
We have a mission to do together. 

I yield back. Thank you for yielding. 

Mr. McCaul. Well, thanks for your comments. 

The Chairman now recognizes the gentleman from Illinois, Mr. 
Davis. 

Mr. Davis. Thank you. 

Thank you very much, Mr. Chairman. 

I would certainly echo the last comments made by yourself and 
the gentleman from Pennsylvania, but I also note that the failures 
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that you discussed earlier actually did occur during the prior ad- 
ministration, and notwithstanding that, it is difficult to not start 
where you start and to not deal with what you have inherited be- 
cause you have got to deal with that. 

So let me ask you Under Secretary, in his written testimony to 
this committee on September 8, 2011, Gene Dodaro, the Comp- 
troller, noted that the Department, and I am quoting now, “has not 
yet developed an integrated financial management system, impact- 
ing its ability to have ready access to reliable information for in- 
formed decision making”. 

Is it your view that the Department’s new approach to its finan- 
cial management system will be able to promote informed decision 
making, despite its component -by-component approach? 

Mr. Borras. Congressman Davis, thank you, again, for your com- 
ment and question. The Department has embarked on a series of 
attempts to modernize the financial systems in the Department; 
eMerge2 and TASC were two of the very visible ones. Both of those 
had as a goal to comprehensively overhaul the entire financial 
management apparatus of the Department and put the Depart- 
ment on a single financial platform. That is a very expensive, a 
very complicated, very resource-intensive undertaking. The ap- 
proach we have taken now is much more what I would call mod- 
ular, much more agile, and much more mindful of the resources 
that we have available. 

Also, we have to recognize that in the Department, the compo- 
nents of the Customs and Border Protection, the Secret Service, 
and FLETC currently operate certified good-standing financial sys- 
tems. There is no reason in my judgment to spend taxpayer money 
to modernize three major systems that are already producing good 
financial outcomes. 

So our approach has been to identify those components that have 
the greatest need in terms of either modernizing the system or up- 
grading the current system. That is a much more responsible finan- 
cial approach. It will take us a little bit longer, but there is no need 
to invest in an entire comprehensive one financial system. So we 
will fix those that are in need, and we will tie those systems to- 
gether, which using technology is a much more cost-effective way 
to do it, rather than build a very big cumbersome system. 

Mr. Davis. Thank you very much. 

Will each of you quickly respond to the Under Secretary’s com- 
ments? 

Mr. Maurer. Absolutely. We certainly had a series of reports 
over the years talking about the Department’s past failed efforts to 
modernize the financial systems. I would certainly agree with the 
Under Secretary’s comments that it is a difficult, expensive, and 
complex undertaking. 

Having said that, from our perspective, what we are looking for 
are the actual outcomes of whatever strategy DHS decides to take 
in modernizing its systems. We certainly understand it has taken 
a different approach, and we will be watching that carefully. What 
we are looking for are actual results and the ability to provide ac- 
tionable financial information to help tie the Department together 
and allow senior leadership to make better-informed decisions. 

Mr. Davis. Mr. Edwards. 
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Mr. Edwards. Thank you, Congressman. 

I agree with the Under Secretary, they are making lots of 
progress. But the Department needs to standardize policies and 
procedures and definitions across the Department. It was such a 
huge manual lift to get the opinion last year. So as long as the De- 
partment can do this, and we are going to be doing a review later 
this month meeting with them on their process going forward. 

Mr. Davis. Thank you very much. 

Thank you, Mr. Chairman. I yield back. 

Mr. McCaul. I thank the gentleman. 

I want to just follow up with a comment about what the Under 
Secretary said, and that is leveraging existing technologies. I talk 
about that a lot. For instance, you know, the Department of De- 
fense has great technologies we have used in Afghanistan and Iraq 
in terms of sensor surveillance that we can use on the Southwest 
Border for instance. But that can apply to so many different other 
areas as well. It doesn’t make any sense to have to start from 
scratch and build it from within the Department when you can ac- 
tually leverage existing, whether it is within the Federal Govern- 
ment or whether it is in the private sector. The private sector has 
a lot of great technology out there that we can leverage. I think in 
the end, it is more cost-effective as well. 

I appreciate your comments about being frugal because I think 
this is a time where we really have to tighten our belts. We don’t 
like it. I prefer to put more money into the Department, but we are 
under very serious budgetary constraints. 

So, with that, I want to thank the witnesses for your testimony. 
The hearing record will be open for 10 days. If Members have addi- 
tional questions, they may send you those, and you can respond in 
writing. 

So, with that, this hearing is adjourned. 

[Whereupon, at 10:35 a.m., the subcommittee was adjourned.] 
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Questions Submitted by Chairman Michael T. McCaul for Rafael Borras 

Question 1. Recently the Office of Program Accountability and Risk Management 
(PARM) was created to implement four new core initiatives: Streamline program 
execution and governance processes, establish a “Centers of Excellence” to share 
best practices, increase visibility of the health of acquisition programs, and advance 
the development of the acquisition workforce. What is the status of those four initia- 
tives and how will they further your efforts to be removed from GAO’s high-risk list? 

Answer. As the executive office for program execution, PARM is responsible for 
the principle DHS policy for acquisition management, Acquisition Management Di- 
rective (MD) 102-01. PARM is working with Component Acquisition Executives 
(CAEs), program managers, and other stakeholders within DHS to change the con- 
struct of MD 102-01 provide a functionally structured policy with the flexibility, 
through an innovative structure, that enables DHS to streamline and improve the 
policy based on stakeholder feedback without needing to re-open the Department’s 
policy change process for the entire Directive. The new process will also facilitate 
development of new guidebooks, addressing areas such as: Portfolio governance, 
cost/schedule monitoring, service contracts, and Quarterly Program Accountability 
Reports (QPARs). 

To advance Centers of Excellence (COE) for Acquisition and Program Manage- 
ment, PARM supported the formation of eight COEs, which have begun providing 
program offices best practices, guidance, and expertise in their respective dis- 
ciplines. The COEs are: Cost Estimating & Analysis COE and Program Manage- 
ment COE (sponsored by PARM); Accessibility Compliance COE, Enterprise Archi- 
tecture COE, and Requirements Engineering COE (sponsored by the Office of Chief 
Information Officer); Privacy COE (sponsored by the Privacy Office); and Systems 
Engineering COE and Test & Evaluation COE (sponsored by Science & Technology 
Directorate). The core team for each COE contains a dedicated Federal FTE along 
with voluntary subject matter expert participation from the components and DHS 
lines of business. PARM established a COE Council to provide strategic direction 
to the COEs, and a COE Coordinating Office to provide planning and communica- 
tions services to the COEs. The Executive Director of PARM chairs the COE Coun- 
cil. The COE initiative supports the effort to remove DHS from the GAO high-risk 
list by building program management capabilities, sharing best practices across 
components, and proactively identifying and addressing program gaps before they 
become major problems. 

DHS is driving a program management paradigm shift to emphasize the criti- 
cality of quality performance data in the decision-making process, not only during 
Acquisition Review Boards (ARBs), but between formal reviews as well. 

In addition, PARM launched the Decision Support Tool (DST) in October 2011, 
which provides DHS leadership a central dashboard for assessing and tracking the 
health of major projects, programs, and portfolios. DHS uses the DST capability to 
inform ARBs with standardized information. Additionally, PARM formed an inde- 
pendent analytic group to translate DST data and build the knowledge needed for 
effective decision making. Moreover, PARM has also produced the Quarterly Pro- 
gram Accountability Report (QPAR), which is used to perform a high-level, “vital 
signs” analysis of each major departmental program (on a quarterly basis) based on 
15 criteria. Like the CASR, the QPAR leverages data from DHS source systems, 
thus minimizing time-consuming data calls. 

PARM is advancing the professional development of the workforce by building the 
Program Management (PM) Corps. PARM collaborates with Acquisition Workforce/ 
Office of Chief Procurement Officer (OCPO), Lines of Business Chiefs (CXOs), Com- 
ponent Acquisition Executives (CAEs), Program Management Offices (PMOs), and 
the Centers of Excellence (COEs) for Acquisition and Program Management. To date 
this has been accomplished, through the development of acquisition courses for dif- 
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ferent PM Corp career paths (Program Manager, Cost Estimator), certifications and 
analysis of workforce gaps. PARM’s focus is to ensure that adequate numbers of ex- 
perienced, trained, and certified professionals are positioned where they are needed 
most, and to raise standards of professionalism and performance. 

The Under Secretary for Management’s Program Management & Execution 
Playbook* outlines the core initiatives described above. The Playbook establishes a 
vision for program governance and management that emphasizes critical thinking, 
problem solving, and program accountability at all levels. 

Question 2. You recently released an Acquisition Management Playbook to place 
greater emphasis on critical thinking and accountability for results, rather than 
merely procedural compliance. Do you as Under Secretary for Management and 
Chief Acquisition Officer have the proper authorities to effectively conduct oversight 
and manage all component acquisition programs? 

Answer. Yes, the USM and CAO positions currently possess sufficient authority 
to oversee all investments, including acquisition programs, throughout their life cy- 
cles. I presently delegate authority to Component Acquisition Executives (CAEs), 
the senior-most acquisition officials within the components. Acquisition Manage- 
ment Directive (MD) 102-01, as well as the Acquisition Playbook, provides the nec- 
essary policy and procedural guidance to inform the acquisition workforce. Those 
documents provide the necessary standards to conduct proper oversight of programs. 

Question 3. In order to be successful integrating management systems across the 
Department, there needs to be standardization of definitions and procedures. For ex- 
ample, different components have different definitions on what is a “cost estimate” 
for an acquisition program. Without standardization any integrated data would be 
inaccurate and useless. What actions have you taken to address these concerns? 

Answer. I recently directed by LOB Chiefs to form a Business Intelligence/Dash- 
board Executive Steering Committee (ESC) to address business intelligence issues, 
including the standardization of definitions and procedures. The group’s charter 
identifies data standardization and a common lexicon as a top priority. The ESC in- 
cludes cross-functional representation from across the Department and will focus 
first on the Department’s acquisition and program management data terms. This 
work will be integrated with DHS training, educational activities, and communica- 
tions. 

All the Acquisition and Program Management Centers of Excellence will serve as 
a forum for engaging the acquisition and program workforce in building a common 
language and discipline for managing the Department’s major investment programs. 
An example is the Cost Estimating and Analysis Center of Excellence (CE&A COE), 
which is charged with building the Department’s acquisition and program manage- 
ment capabilities related to cost estimating and analysis. The CE&A COE developed 
and published a standard and guidance on cost estimating for acquisition programs. 

Question 4. Many acquisition programs fail as a result of not having solid and 
well-defined program requirements. 

How will your new initiatives improve the quality of program requirements at the 
front end and ensure that DHS doesn’t set up acquisition programs for failure? 

Answer. The Department has instituted several changes to improve the quality 
of how program requirements are developed early in a program’s life cycle. The prin- 
ciple changes involve the creation of eight Centers of Excellence (COE) to assist the 
major acquisition disciplines to in all phases of the life cycle. These COE provide 
the program managers with proven practices, tools, standards, and expert support 
to mature requirements definition and program management. 

The Requirements Engineering COE, Systems Engineering COE, and Enterprise 
Architecture COE engage with program managers early in the life cycle to establish 
well-defined requirements, traceability, and configuration management processes for 
the programs. The Test and Evaluation COE provides expert support directly to the 
programs so that Key Performance Parameters are stabilized early in the life cycle. 
This ensures testability and improved the probability that future developmental and 
operational test are successful. 

The Cost Estimating & Analysis COE is working to build an organic capability 
within program offices to develop Life Cycle Cost Estimates (LCCE). The CE&A 
COE is utilizing the GAO publication on cost estimating to validate program LCCE. 

The Program Management COE manages the end-to-end acquisition processes 
and provides coaching and mentoring to programs and components. These include 
integrated scheduling, organizational structures, and contracting approaches. 

The Privacy COE and Accessibility COE are integrated into the Systems Engi- 
neering processes to establish those requirements with programs. The technical re- 


*The document has been retained in committee files. 
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views described in each Systems Engineering Lifecycle Tailoring Plan ensure that 
programs are achieving the requirements associated with these important areas. 

Fostering solid business relationships with industry is also an essential part of 
improving the quality of program requirements at the front end. At the DHS Indus- 
try Day held in January 2012, I emphasized the importance of forging the right kind 
of relationships with industry so that we get maximum benefit from the investments 
funded by taxpayers. All PMs will be required to conduct comprehensive market re- 
search early in the process and document their findings so future contract reviews 
can verify that this important step has been completed. The Senior Procurement Ex- 
ecutive is spearheading a process to encourage early and frequent engagement with 
industry and sites visits. We have created Component Industry Liaison positions to 
respond to industry questions and facilitate more meaningful reaction between DHS 
and industry, and I have directed senior managers to improve the quality of feed- 
back in debriefings, and to enter information into the Contractor Performance As- 
sessment Reporting System (CPARS). 

The Department’s effort to place greater emphasis on the “front-end” strategic 
phase of the acquisition process will ultimately result in a more informed and accu- 
rate procurement forecast. 

Question 5. One of your initiatives to better manage acquisitions is the establish- 
ment of the Investment Review Board. How is it different that the old Acquisition 
Review Board? 

Answer. Plans are underway to expand the functions of the Acquisition Review 
Board (ARB) to include emphasis about non-acquisition “investments.” When fully 
deployed toward the end of fiscal year 2012, the Investment Review Board (IRB) 
will focus more on investments that may include private-sector type information be- 
yond what is traditionally associated with Government contracts. Examples might 
include grants, interagency agreements, leases, and human capital, which collec- 
tively represent approximately 60% of the Department’s total budget. The enhanced 
IRB is intended to provide a more holistic view of DHS investments and resources 
by reviewing the entire landscape of both acquisition programs and non-acquisition 
investments. IRB members will also view the efficiency and effectiveness of invest- 
ments and determine whether redundant or poor performing programs should be 
cancelled or combined with other programs to improve the Department’s return on 
investment. 

The composition of the governance boards (e.g., IRBs) consists of: The Under Sec- 
retary for Management, Under Secretary for Science and Technology, Assistant Sec- 
retary for Policy, General Counsel, Chief Financial Officer, Chief Procurement Offi- 
cer, Chief Information Officer, Chief Human Capital Officer, Chief Administrative 
Officer, and Chief Security Officer, as well as senior component officials. 

Question 6. GAO has reported that the various versions of the Integrated Strategy 
for High-Risk Management do not consistently identify the specific resources the De- 
partment needs to implement planned corrective actions, making it difficult to as- 
sess the extent to which DHS has the capacity to implement these actions. 

What challenges is DHS facing in identifying the specific resources needed to im- 
plement its planned corrective actions? More specifically, what are the resources 
needed? How is the current budget environment affecting these needs? 

Answer. As of February 2012, each LOB Chief has solidified their resource plans 
within each Corrective Action Plan (CAP) and identified a CAP lead to spearhead 
each initiative. Where practical, the goal of each Line of Business (LOB) Chief is 
to furnish dedicated resources, either through internal DHS employees or contractor 
support. As programs mature, LOBs are able to integrate their teams with resources 
from other organizations. 

Question 7. What are DHS’s challenges with integrating its financial information 
and systems, what are the plans for overcoming these challenges, and what are the 
time frames for achieving reliable, useful, and timely financial information for De- 
partment-wide decision making on a day-to-day basis? 

Answer. One of the most significant challenges faced by DHS is multiple, dis- 
parate financial management systems. Many of the existing systems are outdated, 
expensive to maintain and present significant obstacles to the Department’s ability 
to provide timely, accurate enterprise-level information. Recognizing this challenge, 
DHS has unsuccessfully pursued implementation of a seamlessly integrated Depart- 
ment-wide financial management system. After several attempts to acquire a cen- 
tralized financial information system, the Department has changed course to focus 
on a decentralized approach to financial system modernization while improving De- 
partment-wide business process standardization, implementing a common account- 
ing line, and building enterprise-wide business intelligence capabilities. 

These business intelligence capabilities will provide accurate, timely, and reliable 
financial management reporting across the Department. The approach includes con- 
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solidating component financial data, using data checks and analytics to improve 
data quality and better understand trends to improve decision making, and enhanc- 
ing and automating financial reporting for the Department, Congress, OMB, and 
other key stakeholders. 

Business intelligence tools and data standardization will enable DHS to collect 
and map data from component systems to report Department-wide information and 
decrease our reliance on stand-alone data calls and data-entry spreadsheets. DHS 
plans to begin incrementally building business intelligence capability to report De- 
partment-wide financial information consolidated from component core financial sys- 
tems in fiscal year 2012 and plans to continue to develop, expand, and refine this 
during fiscal year 2013 and fiscal year 2014. 

Question 8. GAO has reported that: (1) Few acquisitions have life-cycle cost esti- 
mates, (2) DHS lacks a sufficient financial management system, and (3) DHS senior 
executives are not confident in using acquisitions’ and investments’ performance 
data captured by the Decision Support Tool. 

What is the percentage of DHS acquisitions and investments that have a vali- 
dated and DHS-approved life-cycle cost estimate? 

Given that DHS cannot document how much it is spending or how much it actu- 
ally needs to acquire and maintain its current acquisitions and investments, how 
does DHS determine that it can afford the acquisitions needed to secure the home- 
land? 

What steps is DHS taking to ensure that the Decision Support Tool accurately 
captures program performance on a consistent basis? 

Answer. I created a Cost Estimating & Analysis Center of Excellence (CE&A 
COE) to build the Department’s cost estimation capabilities and to mature the cost 
estimates of major DHS acquisitions and investments. The CE&A COE, which is led 
by the Office of Program Accountability and Risk Management (PARM), is tasked 
with providing components and major program offices best practices, processes, 
guidance, tools, operating models, and expert counsel in cost estimating and anal- 
ysis. 

DHS can document how much it is spending. After years of being on the high- 
risk list maintained by the Government Accountability Office, the Department of 
Homeland Security received its first qualified opinion on its fiscal year 2011 balance 
sheet and statement of custodial activities. Obtaining a qualified opinion is a pivotal 
step in increasing transparency and accountability, as well as accurately accounting 
for the Department’s resources. Moreover, it is a significant milestone that high- 
lights how significantly financial management has improved at DHS. This year’s 
audit results provide clear evidence of continued management improvements at 
DHS. 

In order to make informed investment decisions, DHS directs components to pro- 
vide life-cycle cost estimates (LCCEs) in support of their acquisition programs. A 
LCCE attempts to identify all the costs of an acquisition program, from its initiation 
through disposal of the resulting system at the end of its useful life. LCCEs are 
used to assess whether the investment is affordable within DHS’s long-term funding 
profile. This affordability is a key consideration during Investment Review Board 
deliberations at milestones in the investment life cycle, and annually as part of De- 
partment resource allocation decision making. 

Based on these initiatives, DHS has made progress in getting life cycle cost esti- 
mates approved. We are on track, at a minimum, to double the number approved 
life-cycle cost estimates in fiscal year 2012 over prior years. DHS currently has 
13.3% level 1 LCCEs acquisitions approved with an anticipation of that to grow to 
20% by the end of fiscal year 2012. We expect to see this incremental progress to 
continue as the cost estimating community of practice matures within DHS. 

The Department is taking a number of steps to ensure that program performance 
data used in the Decision Support Tool (DST) is complete, accurate, and valid. The 
DST, which is managed by PARM, pulls data from existing source systems of record, 
which are populated directly by the program offices. 

On February 13, 2012, I signed a memorandum on business intelligence, empha- 
sizing DHS reporting requirements. The memorandum reminds Component Acquisi- 
tion Executives (CAEs) and major programs offices of their responsibility to report 
accurate and complete acquisition program information in DHS systems of record. 
To further encourage accountability, DHS added performance objectives on data 
management and reporting to CAE performance plans. 

In addition, PARM is creating DST reports to identify any programs that are not 
compliant with the reporting requirements. These reports will document incomplete 
data fields for each major investment. PARM is also conducting manual data defi- 
ciency reviews on major investments, as well as continued outreach to DHS stake- 
holders (workshops, briefings, and one-on-one communications) to underscore the 
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importance of reporting compliance. PARM's outreach serves to set expectations that 
the Department is using reported performance data to inform Acquisition Review 
Boards (ARB), annual and quarterly Comprehensive Acquisition Status Reports 
(CASR), Quarterly Program Accountability Reports (QPAR), as well as day-to-day 
decisions between formal program reviews. 

Question 9. DHS plans to establish a new framework (the Integrated Investment 
Life Cycle Model) for managing investments across its components and management 
functions. This framework includes creating new department-level councils to iden- 
tify priorities and capability gaps, make resource decisions, and monitor and assess 
the implementation of investment decisions. 

DHS has had previous department-level resource decision-making bodies, such as 
the Joint Requirements Council. What were the roadblocks for previous department- 
level resource decision-making bodies? 

What steps is DHS taking to ensure that these new councils are successful in 
managing a broad portfolio of mission needs, acquisitions, and investments? 

What is the status of standing up these new decision-making bodies, specifically 
the Department Strategy Council, Functional Coordination Offices, and Capabilities 
and Requirements Council? 

Answer. Since its inception in 2001, the Department has continuously worked to 
improve how it manages its multi-billion dollar investment portfolio. Creating a 
Joint Requirements Council (JRC) in 2003 was an important achievement to iden- 
tify cross-cutting opportunities and leverage common requirements. According to 
GAO, the JRC lacked adequate oversight and accountability. I was mindful of this 
information when I directed my staff to develop the IILCM, which is designed to 
consider a broader range of investment factors. 

For example, since my arrival to the Department nearly 2 years ago, I committed 
to strengthen all phases of acquisition management. This includes better cost esti- 
mating, deploying business intelligence to inform key strategy decisions and expand- 
ing the responsibilities of the ARB to have a more holistic view of DHS resources 
by reviewing both acquisition programs and non-acquisition investments. 

However, before any substantive changes could be made, I concluded that key 
structural changes to the way decisions are evaluated and concluded had to be one 
of my first steps. While the JRC was an important forum, it was just one part of 
the overall landscape. Working with my counterparts in the components, as well as 
my direct reports (e.g., LOB Chiefs), we developed the IILCM. The IILCM is a con- 
ceptual framework to consider the viability of investment decisions, from the time 
it is first conceptualized through execution. 

In general terms, the IILCM has already been initiated, albeit in a phased ap- 
proach given the need to pilot/test the concepts and account for the challenges of 
an incrementally funded budget process through the use of continuing resolutions. 

The IILCM concept is multi-dimensional, not linear. Each phase requires testing 
and coordination at both the Department and component levels. Rather than adopt- 
ing a single, “big bang” approach, each function (e.g., Board/Council) is being “initi- 
ated” in phases or segments. Some phases have matured faster than others, espe- 
cially those functions that fall within the domain of the Management Directorate 
lines of business. 

Figure 1 displays the key tenets of the IILCM and provides a multi-dimensional, 
inter-related process that ties investments to mission goals. This model integrates 
the top mission objectives identified by the Secretary with the long-standing Plan- 
ning, Programming, Budgeting, and Execution process. In addition, it identifies par- 
ticipants and decision makers from key organizations whose involvement is based, 
in part, on their functional responsibility. 
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In general terms, the IILCM has already been initiated, albeit in a phased ap- 
proach, given the need to pilot/test mission-related concepts and the challenges 
posed by an incrementally-funded budget process. The IILCM is multi-dimensional, 
not linear. This means that changes or decisions made by an ARB could, and likely 
will, have a ripple effect on earlier stages (e.g., DSC, CRC). For example, Program 
A may be determined at the ARB to be underperforming or possess obsolete tech- 
nology. As such, the CRC may determine during a trade-off exercise that to improve 
the quality and viability of investment decisions. 

Questions Submitted by Chairman Michael T. McCaul for David C. Maurer 1 

Question 1. Do you believe the President’s fiscal year 2013 budget proposal pro- 
vides DHS the resources and capacity to make greater progress removing them from 
the high-risk list? 

Answer. The absence of resource information for many of the corrective actions 
DHS identified in its strategy for addressing our high-risk designation makes it dif- 
ficult to fully assess the extent to which the Department has the resources and ca- 
pacity to implement its strategy. Without this information, neither DHS nor we can 
fully assess the extent to which the Department has the capacity to implement 
these actions. Specifically, in its December 2011 Integrated Strategy for High-Risk 
Management, DHS did not consistently provide information on what the specific re- 
source needs are or what additional resources may be needed to implement the cor- 
rective actions — actions intended to move the Department toward removal from our 
high-risk list. 

Question 2a. For nearly a decade DHS has attempted to modernize and integrate 
its financial management systems. As of May 2011, DHS canceled the Trans- 
formation and Systems Consolidation (TASC) program, its third attempt to integrate 
financial systems. Now DHS is attempting to move forward with a new Financial 
Modernization effort. 

Do you have any reservations with their new strategy to enhance its integration 
of financial management systems? 

Answer. It is too soon to assess DHS’s new, decentralized approach for modern- 
izing its financial management systems because this approach is in its early stages 


1 [ . . . ]The responses are based on previously issued GAO products.! . . . ]See GAO, De- 
partment of Homeland Security: Continued Progress Made Improving and Integrating Manage- 
ment Areas, hut More Work Remains, GAO-12-365T (Washington, DC: Mar. 1, 2012); GAO, In- 
formation Technology: Department of Defense and Energy Need to Address Potentially Duplica- 
tive Investments, GAO-12—241 (Washington, DC: Feb. 17, 2012); GAO, Financial Management 
Systems: DHS Faces Challenges to Successfully Consolidating Its Existing Disparate Systems, 
GAO-10—76 (Washington, DC: Dec. 4, 2009); GAO, DepaHment of Homeland Security: Billions 
Invested in Major Programs Lack Appropriate Oversight, GAO-09-29 (Washington, DC: Nov. 18, 
2008); and GAO, Financial Management: Long-standing Financial Systems Weaknesses Present 
a Formidable Challenge, GAO-07-914 (Washington, DC: Aug. 3, 2007). 



43 


with many pieces still being defined by the Department. However, we have pre- 
viously reported that agencies that do not have integrated systems, such as DHS, 
are likely to expend more time, effort, and resources in compiling routine financial 
information and periodic financial statements. 2 Without any definitive information 
on DHS’s new approach, it is not clear whether the approach will result in systems 
that generate reliable, useful, timely financial information for day-to-day decision 
making and agency oversight. Specifically, as of February 2012, DHS had not identi- 
fied the Federal service provider that will be used by the Federal Emergency Man- 
agement Agency’s financial management system — the first system scheduled for 
modernization. Additionally, DHS has not yet identified the specific approach or 
necessary resources and time frames for implementing new systems at U.S. Coast 
Guard and Immigration and Customs Enforcement — the next two components iden- 
tified for modernization. 

Further, agencies that embark on financial system modernization projects without 
having a clear road map increase the risk of cost overruns, schedule delays, and 
other project failures. We have consistently reported that agencies should develop 
planning documents that describe, at a high level: (1) How all agency financial sys- 
tems would relate to each other, (2) how information would flow from and through 
these systems, and (3) which system would be considered the official system of 
record for master data. 3 Further, planning documents provide a useful tool to ex- 
plain how financial management systems at the component and department levels 
would operate cohesively. The planning documents should be geared to an agency- 
wide solution rather than individual component, stove-piped efforts and establish 
mechanisms to monitor program cost, schedule, and performance. We will continue 
to monitor DHS’s financial management system modernization efforts. 

Questions Submitted by Ranking Member William R. Keating for David C. 

Maurer 

Question la. GAO first designated DHS’s implementation and transformation as 
high-risk in 2003 because of the difficulty of transforming 22 disparate agencies into 
one department. In addition, many of these individual agencies were facing their 
own management and mission challenges. But most importantly, the failure to effec- 
tively address DHS’s management challenges and program risks could have serious 
consequences for our homeland security as well as our economy. DHS trans- 
formation remained on the high-risk list in 2005, 2007, 2009, and 2011 and GAO 
is preparing to issue its next high-risk update in January 2013. 

What actions has the Department taken since GAO’s 2011 high-risk update to 
transform and integrate the Department? 

Answer. DHS has taken several actions to implement and transform the Depart- 
ment in each of the management areas — human capital, financial management, in- 
formation technology, and acquisition management — and management integration 
as illustrated in the examples below. 

• DHS initiated a Senior Executive Service Candidate Development Program in 
May 2011 to build its senior leadership pipeline within the Department. 

• DHS achieved its goal of receiving a qualified audit opinion on its consolidated 
balance sheet in fiscal year 2011 by moving from a disclaimer of opinion to a 
qualified audit opinion on its balance sheet and statement of custodial activity 
for the first time since the Department’s creation. 4 

• DHS consolidated six personnel security-related systems into its Department- 
wide Integrated Security Management System as part of its efforts to stream- 
line and consolidate the Department’s human resources investments. 5 

• In October 2011, DHS established the Office of Program Accountability and 
Risk Management (PARM) to enhance its ability to oversee major acquisition 
programs — realigning the acquisition management functions previously per- 
formed by two divisions within the Office of Chief Procurement Officer and ele- 
vating PARM to report directly to the Under Secretary for Management. 


2 GAO-07-914. 

3 GAO-10-76. 

4 A qualified opinion states that, except for the effects of the matter(s) to which the qualifica- 
tion relates, the audited financial statements present fairly, in all material respects, the finan- 
cial position, results of operations, and cash flows of the entity in conformity with generally ac- 
cepted accounting principles. The matter(s) to which the qualification relates could be due to 
a scope limitation, or the audited financial statements containing a material departure from 
generally accepted accounting principles, or both. A disclaimer of opinion states that the auditor 
does not express an opinion on the financial statements (e.g., of scope limitations). 

5 GAO-12-241. 
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• In the management integration area, DHS has promoted accountability for 
management integration among Department and component management chiefs 
by, among other things, having the Department chiefs provide written objectives 
that explicitly reflect priorities and milestones for that management function as 
well as aligning the component chiefs’ individual performance plans to the De- 
partment’s goals and objectives. 

In addition, DHS has continued to update and strengthen its strategy for address- 
ing our high-risk designation for implementing and transforming the Department. 
Specifically, DHS provided updates to its Integrated Strategy for High-Risk Manage- 
ment in June and December 2011. These updates identify, among other things, the 
Department’s management initiatives and corrective actions for addressing its man- 
agement challenges. The Department is working on another update to the strategy, 
which it expects to provide us in June 2012. 

Question lb. What should be the Department’s focus going forward? 

Answer. DHS needs to focus on executing its Integrated Strategy for High-Risk 
Management and show measurable, sustainable progress in implementing its man- 
agement initiatives and corrective actions and achieving outcomes. 

Question 2a. In February 2012, GAO reported that DHS had developed and start- 
ed to implement an hitegrated Strategy for High-Risk Management and corrective 
action plans for acquisition, information technology, financial, and human capital 
management functions. 

What is GAO’s assessment of the plan? 

Answer. Overall, we believe that the December 2011 Integrated Strategy for High- 
Risk. Management positions DHS to address its management challenges and the im- 
plementation and transformation high-risk area. We identified four areas in which 
the Department could strengthen or clarify the strategy to better enable DHS and 
GAO to assess the Department’s progress: (1) More clearly and consistently report 
the resources available to implement corrective actions; (2) consistently report on 
DHS’s rationale for adding or removing corrective actions; (3) establish measures 
and report on progress for all initiatives; and (4) stabilize the methodology for meas- 
uring progress. By strengthening these four aspects, we believe the December 2011 
strategy, if implemented and sustained, provides a path for DHS to address our 
high-risk designation. 

Question 2b. What actions is DHS taking to implement the Integrated Strategy? 

Answer. DHS is taking actions to implement its Integrated Strategy in each of 
the management areas — human capital, financial management, information tech- 
nology, acquisition management, and management integration — as illustrated in our 
response to question 3a. 

Question 2c. Is DHS committed to implementing this strategy, including dedi- 
cating the resources required to fully implement the corrective actions set forth in 
the strategy? 

Answer. DHS’s Secretary and Deputy Secretary and other senior officials have 
demonstrated commitment and top leadership support to implementing the Depart- 
ment’s Integrated Strategy for High-Risk Management. However, it is not always 
clear whether DHS is dedicating the resources required to fully implement the cor- 
rective actions set forth in the strategy because the Department has not consistently 
identified the resources it needs or met its target completion dates. 

Question 3. GAO reported that its prior work has identified challenges related to 
acquisition oversight, cost growth, and schedule delays, including Departmental con- 
cerns about the accuracy of cost estimates for some of DHS’s major programs. 

What progress has DHS made in establishing an oversight body to inform high- 
level trade-off decisions about its acquisition programs? 

Answer. DHS has made some progress overseeing individual acquisition pro- 
grams, but does not have a high-level, decision-making body for considering trade- 
offs across its entire portfolio of investments. In 2003, DHS established the Joint 
Requirements Council (JRC) to identify cross-cutting opportunities and common re- 
quirements among DHS components, and help determine how DHS should use its 
resources. When it met regularly, the JRC played a key role in identifying several 
examples of overlapping investments, including passenger screening programs. Dur- 
ing 2006, the JRC stopped meeting after the chair was assigned to other duties 
within the Department. In 2008, DHS representatives recognized that strengthening 
the JRC was a top priority, and we recommended that DHS reinstate it or establish 
another joint requirements oversight board. 6 

In September 2010 we identified and provided to DHS 31 actions and outcomes 
that are critical to addressing the challenges within the Department’s management 
areas and in integrating those functions across the Department. Among these ac- 


6 GAO-09-29. 
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tions and outcomes, we reiterated the need to create a joint requirements oversight 
board, and in response, DHS stated that it would establish an executive decision 
structure — presented as the Integrated Investment Life Cycle Model (IILCM) — to 
prioritize capabilities and requirements across components by the end of fiscal year 
2011. As part of this proposed structure, a “Capabilities and Requirements Council” 
would consider trade-off decisions across DHS’s portfolio of investments. However, 
in the December 2011 version of the Department’s Integrated Strategy for High-Risk 
Management, DHS reported that the IILCM will not begin operations until the end 
of fiscal year 2012. 

DHS has operated an Acquisition Review Board — recently renamed the Invest- 
ment Review Board — since 2008, and this board has instructed individual programs 
to identify alternative acquisition approaches, reconsider requirements, and pursue 
cost-saving efforts. The board has also instructed individual programs to produce 
summaries of related activities within DHS and the Department of Defense. How- 
ever, DHS continues to operate without an oversight board, similar to the JRC, re- 
sponsible for considering trade-offs across its entire portfolio of investments. 

Questions Submitted by Chairman Michael T. McCaul for Charles K. 

Edwards 

Question la. DHS has stated, “The Department has not ensured or mandated that 
components use all available acquisition tools and best practices guidance to provide 
transparency and efficiency.” 

Do components knowingly choose not to use these “best practice” acquisition tools 
for support? Or, are they not aware that these tools even exist? 

Answer. The Department has generally made progress in its acquisition oversight 
processes and controls through implementation of a revised acquisition management 
directive. However, the Department did not ensure that components were using all 
acquisition tools available and that all components had adequate policies and proce- 
dures in place to manage acquisition programs. As we reported this past year, the 
Department had not ensured or mandated that components use all available tools 
and supporting programs, including the next-generation Periodic Reporting System 
(nPRS) and the Department’s Strategic Sourcing Program Office (SSPO), to provide 
transparency and efficiency of component acquisition programs. Some components 
developed systems comparable to nPRS and may have awarded contracts without 
consideration of the SSPO. As a result, the Department did not have complete visi- 
bility of all programs within its acquisition portfolio. 

Question lb. What needs to be done to ensure that these new Centers of Excel- 
lence to share tools and best practices will be successful? 

Answer. The Department’s Acquisition Program Management Division recently re- 
organized to become the Office of Program Accountability and Risk Management 
(PARM) on October 1, 2011 under a Centers of Excellence model. The Department 
has not taken steps to ensure that all components have developed prescribed poli- 
cies and procedures for oversight of acquisition programs. Directive 102-01 states 
that components retain the authority to set internal acquisition processes and proce- 
dures, as long as they are consistent with the spirit and intent of the directive. 
However, not all components have created such policies and procedures, and the De- 
partment has not taken steps to ensure the adequacy of the processes and proce- 
dures that components developed. We recommended that DHS implement a plan of 
action for Department-wide finalization of acquisition management policies and pro- 
cedures. The DHS Under Secretary for Management addressed the desire for each 
component to have a Component Acquisition Executive to lead a process and staff 
to provide acquisition and procurement oversight, policy, and guidance to ensure 
that statutory, regulatory, and higher-level policy requirements are fulfilled. This is 
a good start. However, PARM needs to effectively implement their Centers of Excel- 
lence model, and aggressively work with Component Acquisition Executives if they 
are to ensure their Centers of Excellence model successfully shares tools and best 
practices. 

Questions Submitted by Ranking Member William R. Keating for Charles K. 

Edwards 

Question 1. The latest version of the OIG’s annual report on major management 
challenges facing the Department states that it’s Department’s financial manage- 
ment reporting “has achieved a significant milestone. For fiscal year 2011, the De- 
partment was able to produce an auditable balance sheet and statement of custodial 
activity; and the independent auditors rendered a qualified opinion on those state- 
ments.” 
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Please discuss the importance of this achievement by the Department relative to 
the scope of the financial management challenges it faces? 

Answer. DHS’ achievement of a qualified opinion on its balance sheet and state- 
ment of custodial activity in fiscal year 2011 is important because it shows that 
DHS is improving controls over the financial administration of its programs and op- 
erations. 

However, the independent auditor noted that DHS’ financial information tech- 
nology (IT) infrastructure is aging and found financial system functionality limita- 
tions at all of the significant DHS components. As a result, some components are 
forced to use extensive inefficient manual processes and workarounds to process re- 
ports and report financial data. In addition, weaknesses in the general control envi- 
ronment are interfering with more extensive use of IT application controls needed 
to improve efficiencies in operations and reliability of financial information. Until 
DHS modernizes its aging financial systems and IT controls and systems, 
functionality limitations will continue to be a major factor contributing to DHS fi- 
nancial management challenges. 

Question 2a. Improving the acquisition workforce has been noted as a key acquisi- 
tion management priority at the Department. Recently, the Department added ac- 
quisition workforce development as a management initiative. 

What progress has the Department made in building and sustaining a sufficient, 
capable, and properly trained workforce to support its acquisition portfolio? 

Answer. DHS made progress in the recruitment and retention of a workforce ca- 
pable of managing a complex acquisition program. The number of procurement staff 
has more than doubled since 2005. In addition, participation in the Acquisition Pro- 
fessional Career Program, which seeks to develop acquisition leaders, increased 62% 
from 2008 to 2010. Nevertheless, DHS continues to face acquisition workforce chal- 
lenges across DHS. For example: 

• GAO reported that the United States Coast Guard (Coast Guard) reduced its 
acquisition workforce vacancies from approximately 20 percent to 13 percent. 
According to its August 2010 human-capital staffing study, program managers 
reported concerns with staffing adequacy in program management and technical 
areas. To make up for shortfalls in hiring systems engineers and other acquisi- 
tion workforce positions for its major programs, the Coast Guard uses support 
contractors, which constituted 25 percent of its acquisition workforce as of No- 
vember 2010. 

• Acquisition staff turnover in FEMA has exacerbated file maintenance problems 
and resulted in multimillion-dollar contracts not being managed effectively or 
consistently. One of FEMA’s challenges is hiring experienced contracting offi- 
cers to work at disasters. The majority of FEMA staff at a disaster site work 
on an on-call, intermittent basis. 

Question 2b. Please explain the current shortfalls of the Department’s acquisition 
workforce and how the Office of Program Accountability and Risk Management is 
addressing these shortfalls. 

Answer. In its March 2010 Acquisition Human Capital Plan, DHS defined acquisi- 
tion workforce as “contracting specialists/officers, program managers, and con- 
tracting officer’s technical representatives.” The Plan says that one of tbe hardest- 
to-fill occupational series within the Federal Government is the 1102 contracting se- 
ries (contract specialist) and focuses on attracting and maintaining 1102s. 

The Plan projected that DHS needed to annually increase the number of 1102s 
by 5% each year to maintain a workforce that keeps pace with projected workload. 
From a presumed adequate base of 1,326 at the end of fiscal year 2009, DHS esti- 
mated that it will need 299 more 1102s by the end of fiscal year 2014. In the March 
2011 Plan update, DHS reported that it will continue to expand the acquisition 
workforce through the acquisition certification programs, acquisition professional ca- 
reer program, and centralized acquisition training program. The Plan update also 
indentified new initiatives that will allow DHS to capture certification and training 
records of the acquisition workforce and develop a staffing tool to determine optimal 
1102 staffing levels relative to workload volume and complexity. 

In response to OIG and GAO recommendations, the DHS Under Secretary for 
Management restructured oversight of all major acquisition programs in fiscal year 
2011. A key part of this restructuring was the elevation of the Program Account- 
ability and Risk Management (PARM) Office to be a direct report to him. The 
PARM Office was designed to: (1) Manage, implement, and guide DHS managers 
of major investments through the acquisition governance process, (2) provide inde- 
pendent assessments of major investment programs, (3) work with DHS partners to 
enhance business intelligence to inform Acquisition Review Board decisions, and (4) 
monitor programs between formal reviews to identify any emerging issues that DHS 
needs to address to keep the programs on track. 
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We have not yet reviewed the new PARM initiative and what effect it may have 
on the acquisition workforce. However, if fully implemented and sustained, we be- 
lieve this program is a good approach toward more effective acquisition management 
at DHS. 

Question 3. In the current fiscal environment of doing more with less, are the De- 
partment’s efforts to develop a better acquisition workforce reasonable (i.e., afford- 
able and practical)? 

Answer. DHS has taken action to implement and transform its acquisition work- 
force, but like many Federal agencies it still faces challenges recruiting and retain- 
ing quality staff. Rebuilding the Federal acquisition capability represents a sensible 
investment where money spent on hiring and training should pay off in terms of 
improved contracting and a reduction in waste and fraud. While progress is being 
made, much remains to be accomplished before procurements are managed effec- 
tively. Almost every contracting challenge facing DHS — in particular, poor acquisi- 
tion planning, unjustified sole-source contracts and inadequate oversight of contrac- 
tors — can be traced back to the Federal Government’s failure, beginning in the early 
1990’s, to invest in the Federal acquisition workforce. 

While the size of the acquisition staff is important, ultimately, it is the quality 
of the workforce that determines the quality of acquisition outcomes. To be success- 
ful, as DHS finishes their capacity-building initiative, it will need to focus attention 
on: 

• developing ways to deal with the acquisition “sustainability question” to retain 
interns and new hires for more than just a few years; 

• improving the capability of the acquisition workforce that they currently have, 
which includes training, right-sizing, and right-shaping the workforce; 

• becoming “One DHS” focused on establishing a cohesive, efficient, and effective 
organization; and 

• enhancing and integrating acquisition processes and technology. 

Question 4a. The DHS OIG continues to report a material weakness related to in- 
formation technology security and has identified information security as a major 
management challenge. In the December 2011 Integrated Strategy for High-Risk 
Management, the Department reports that it mostly addressed information tech- 
nology security. 

What specific steps is the Department taking to strengthen its information tech- 
nology security and to address the weakness identified by the Office of Inspector 
General? 

Answer. For the DHS Annual Financial Statement, KPMG continues to identify 
a material weakness in the area of Information Security. During the fiscal year 
2011 financial statement audit, DHS did show some improvements toward strength- 
ening its information technology security. The drivers for the material weakness in 
information technology during fiscal year 2011 were the Coast Guard and FEMA. 
Specific steps that the Coast Guard, FEMA, and the remainder of the Department 
have taken to strengthen information technology are: 

For Coast Guard: 

• During fiscal year 2011 audit, Coast Guard took corrective action to address 
nearly half of the prior year IT control weaknesses. Coast Guard made improve- 
ments by strengthening its system security settings over some of its systems lo- 
cated at the Operations Systems Center (OSC), Aviation Logistics Center (ALC), 
and USCG Finance Center; strengthening controls over audit log reviews at 
ALC; and improving data center controls at OSC and ALC. 

• Coast Guard took actions to improve aspects of its system password settings, 
data center physical security, and scanning for system vulnerabilities. 

For FEMA: 

• FEMA made improvements over implementing certain logical controls over 
FEMA and National Flood Insurance Program information systems, as well as 
development and implementation of controls around patch management and 
vulnerability management. 

• FEMA made improvements in IT entity-level controls, including those related 
to incident response and handling, contractor management, and IT investment 
life-cycle management. 

Question 4b. What are some key indicators of success that weaknesses have either 
been mitigated or corrected by the Department? 

Answer. Key indicators that we feel show that the Department is successfully 
mitigating or correcting the material weakness: 

• The number of prior-year IT audit findings for the Department as a whole has 
decreased. 

• There have been fewer new IT issues identified at the Department this past 
audit year. This is due to the increased focus of the components on remediating 
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the prior-year issues and beginning to identify the root causes of the system- 
related issues. 


o 



